Regular badNonce errors

[cpu]

Hi @bruncsak, thanks for the follow-up information!

@bruncsak

I wonder why is that matter? A nonce should be accepted precisely one time independently of client IP addresses

The nonce pool is per-environment (staging vs prod) and per-datacentre. If the egress IP changes between requests our load balancing may send a request that retrieved a nonce from one DC to another DC that doesn't know it.

Since the user is only using one IP we can rule this out as a problem.

@bruncsak

I asked the user is there a problem is domain names are revealed due to the debug output? He prefers private channel to disclose that information. I will still try to improve the debug without disclosing domain names.

Great, thanks! I provided my e-mail to the user on the Github ticket so they can send the domains to me that way.

@bruncsak

That is a feasible workaround for the problem. On the other hand I prefer postpone it unless we can find a solution to the problem.

This isn't a workaround per say - even if we resolve this particular problem it's a best practice that will help in the future if (for example) a nonce expires out of the pool between when you get it and use it.

@bruncsak

For the time being I cannot even exclude the option that an actual man-in-the-middle attack goes on between the user’s ACME client and the boulder server. With that workaround the client side protection is weakened because the attacker may force a set of invalid transactions helping to collect information to improve its attack.

I think you are misunderstanding the purpose of the nonce. I recommend you review Section 6.4 and the ACME threat model. The nonce is strictly to prevent replay attacks from a middle party that terminates the TLS connection (e.g. a CDN). The goal is to prevent the CDN from replaying a request it processed and forwarded to the ACME server previously. A man-in-the-middle attacker is unable to modify the ACME request without breaking the JWS that authenticates it with the user's account key. Retrying requests on nonce-failure will not give a MITM any information they couldn't already observe.