Keeping Getting JWS has an invalid anti-replay nonce

[pnotes]

I am attempting to issue a certificate (using LetsEncrypt’s staging endpoint) for litafi.com by completing a dns-01 challenge but running into 2 issues that I would appreciate help understanding/resolving.

First Issue

From reading docs of acme-client, I suspect that the initial payload, when an order for a certificate is made, should have a order.challenge.status == pending.

Yet, each time a request for a certificate order is made, the return value of the dns order.challenge.status == valid as the payload below demonstrates:

    body:
      encoding: UTF-8
      string: |-
        {
          "identifier": {
            "type": "dns",
            "value": "litafi.com"
          },
          "status": "valid",
          "expires": "2019-01-25T02:46:00Z",
          "challenges": [
            {
              "type": "tls-alpn-01",
              "status": "pending",
              "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning",
              "token": "someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning"
            },
            {
              "type": "dns-01",
              "status": "valid",
              "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning",
              "token": "someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning",
              "validationRecord": [
                {
                  "hostname": "litafi.com"
                }
              ]
            },
            {
              "type": "tls-sni-01",
              "status": "pending",
              "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning",
              "token": "someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning"
            },
            {
              "type": "http-01",
              "status": "pending",
              "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning",
              "token": "someAlphaNumericValueThatIDoNotKnowIfMeantToBeKeptSecret.BearWithMeIAmStillLearning"
            }
          ]
        }

• This valid status always results in a JWS has an invalid anti-replay nonce: "YcrgSgEmUhl2pUc0vbDwu1OlOmMQ3Q2pwMSSfLbc014" when I attempt to verify the challenge. I have revoked all the certs that I generated while testing but this issue still persists.

Second Issue

While attempting to resolve the problem, I used Google’s CT Log and Comodo’s CT log to see the historical report.

• CT shows that the leaf certificate was issued on 24/11/2018 and revoked on 25/11/2018. Does this mean that the certificate is no longer valid? Might this be the cause of the first issue?

[JuergenAuer]

Hi @pnotes

@pnotes

Yet, each time a request for a certificate order is made, the return value of the dns order.challenge.status == valid as the payload below demonstrates:

if you have created a certificate, Letsencrypt allows you (next 30 days) to create a new certificate without re-checking your challenge.

So: Create a certificate -> challenge is valide, order a new certificate (a few days later) with the same domain name set -> challenge isn't pending, instead valide.

@pnotes

invalid anti-replay nonce

is a different thing. Letsencrypt requires clients to send a nonce, a random string with a short lifetime. If your client wait's too long (I think, more then 5 minutes), the nonce is invalide.

But a client should check that and order a new nonce. So the client is buggy.

[pnotes]

@JuergenAuer. Thanks for the clarification; will review my code then review the client before raising any more issues.

Update: client isn’t buggy; I was waiting too long between requests.

[JuergenAuer]

@pnotes

client isn’t buggy; I was waiting too long between requests.

But if an ACME-client has an option to wait, it's possible that the user waits one or two hours (dns-propagation).

So the ACME-client should fetch a new nonce.

[pnotes]

Ha! thanks for pointing that out. This is an opportunity to learn more so will raise the issue with the maintainer (and maybe submit a PR - fingers crossed )