Our nightly regressions test our ACME client, one test creates then revokes a certificate using LE Staging. The test has run fine for months, it started failing 15 October. The tests and the client havent changed in months. This revocation failure reproduces in LE Production as well. The specific…

Thanks for the feedback, i changed reason to 0 and the revocation does seem to work now. I will do more rigorous testing when back at work but appreciate your insight (and that from petercooperjr). Note that Pebble doesnt have this same behavior (at least when using letsencrypt/pebble:latest).

It is strange that this was changed without explanation in the pull request and without an API announcement. I can't find any spec for it either. I could speculate that Let's Encrypt wants to discourage people from using the key compromise reason, since they have to store a list of compromised keys …

I agree that this is the kind of change that should have been mentioned in API Announcements. @jple Going to bug you on this one too. :slight_smile:

There's also this from the CPS : Subscribers can revoke certificates belonging to their accounts via the ACME API if they can sign the revocation request with the associated account private key. No other information is required in such cases. Now, that's not saying anything about revocation reaso…

More info forthcoming! I'll chat with the team.

Also could you advise wrt using Pebble to test functionality - it was my impression that Pebble can force encounters with use cases that may never happen with Boulder. In this case Pebble allowed the revocation while Boulder failed it. Thanks!!!

If anyone does figure out the reason, IMHO this behavior should be added to either the "Divergences" or "Implementation Details" docs for Boulder. (I'm not sure yet which one it belongs to) boulder/acme-divergences.md at main · letsencrypt/boulder · GitHub boulder/acme-implementation_details.md a…

and maybe Revoking certificates - Let's Encrypt ?

That page is written for the general public, and are really limited to the popular/official LetsEncrypt clients. Client maintainers should be referencing the divergences/details documents; and the API announcements. This should have been published on both. Very frustrating - I'll need to create t…

'JWS verification error' trying to revoke a certificate

Client dev

JamesLE December 13, 2021, 11:50pm 22

Here's the related announcement: Change in Revocation Methods Due to a (now patched) ACME bug

Topic		Replies	Views
Question re: Change in Revocations Methods Issuance Policy	50	3948	December 16, 2021
Questions re: Upcoming changes to revocation reasons Issuance Policy	23	2154	September 21, 2022
Revocation behaviour Client dev	2	1335	February 15, 2018
Upcoming changes to revocation reasons API Announcements	1	1585	September 21, 2022
Change in Revocation Methods Due to a (now patched) ACME bug API Announcements	0	2969	December 13, 2021

'JWS verification error' trying to revoke a certificate

Related topics