[RESOLVED] Various errors while generating a CSR, Not sure which is "better", need help finding a bug

Client dev
27

The one tip I give everyone writing an ACME client - write a lot of unit and functional tests. Write tests to cover your encoders and decoders, and then tests to chain their outputs into a roundtrip. Those will usually help you find and fix the various bugs others mentioned above, and quickly surface errors once you have maintainable code and start to make changes.

You should have tests that cover all your functions before you start talking to an ACME server, and when you get to that point you can do local tests against Pebble.

29

Oh, I figured it out, the SET tag was missing from the sequence

SEQUENCE {
    SET {                     <-- this was missing
        SEQUENCE {
            OBJECT IDENTIFIER commonName (2.5.4.3)
            UTF8String 'your-domain.com'
        }
    }
}

Now I get the error

Error getting order {
  type: 'urn:ietf:params:acme:error:unauthorized',
  detail: 'Error finalizing order :: CSR does not specify same identifiers as Order',
  status: 403
}

This is the error I was expecting all along because i didn't provide the SAN Extension so the identifiers don't match.

I cleaned up some posts so this can be helpful and not confusing, thanks everyone.

If you want help and you understand Javascript you can use server-ssl as an example

30

Thanks for your help everyone.

My project server-ssl can generate Lets Encrypt! certificates automatically now.

J@BUD MINGW64 ~/Desktop/server-ssl (main)
$ ./start-windows.bat --letsEncrypt --domains=["www.ssl.boats","ssl.boats"] --generateAnyway --staging
Generating Keys for Local Development
........+...+....+........+.+++++++++++++++++++++++++++++++++++++++*.+..........+.....+..........+.....+...+...+++++++++++++++++++++++++++++++++++++++*.+...+....+......+...+.....+......+..........+...+..+......+....+...+..+.+...+...............+.........+..+...+.............+...+............+........+..........+..+.......+...+..+............+.+........+....+...+..+..........+.....+...+..................+.++++++
......+...+...+........+++++++++++++++++++++++++++++++++++++++*.....................+...+......+..+...+.+...+..........................+.........+...+++++++++++++++++++++++++++++++++++++++*.......+.....+..........+.....+......+...+...............+....+........+...+......+...+.......+.....+......+...................+.....+...+.+.....+......+.+........+.......+........+............+...+.......+.........+...+......+.........+...+.........+.....+....+...............+..+....+...+............+...+..+......+...+............+.........+......+.......+...+..+......+.+......+.........+.....++++++
-----
Successfully Generated Private Key
Successfully Generated Certificate
Node.js already exists
Starting SSL Web Server
USING THE STAGING SERVER
HTTPS Server is running on port 443
HTTP Server is redirecting requests to 443
ACME Keys saved to File
Signing Keys saved to File
------
Starting Lets Encrypt Daemon!
This does not currently generate certificates.
Next Nonce jDZhkUVkXbilwrLdlKRMLMe8zUsYhB2ieIVPgt_9BcpoegCeDRU
Next Nonce jDZhkUVkUGYniolyYph5PYoOfuUWVsDdy5YeMe9hT1L1kopRQrc
Next Nonce jDZhkUVkYru8LaUO6JD7owcltUu8i2O6qH8BOkTcts9LhEh3QUY
Next Nonce FW9SwLSLe9G1hdAt2UqPF8wM-HyWyj7r1Mf-356mPhU4f8l4-Lg {
  answer: {
    get: {
      type: 'http-01',
      url: 'https://acme-staging-v02.api.letsencrypt.org/acme/chall/172971744/15063525884/-ro1FA',
      status: 'pending',
      token: 'Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c'
    },
    location: 'https://acme-staging-v02.api.letsencrypt.org/acme/chall/172971744/15063525884/-ro1FA'
  },
  nonce: 'FW9SwLSLe9G1hdAt2UqPF8wM-HyWyj7r1Mf-356mPhU4f8l4-Lg'
}
Next Nonce jDZhkUVkOwDcuxJVrlC8zIma1tMxLgEUW6ejHPQUvj-qRLtcebc {
  answer: {
    get: {
      type: 'http-01',
      url: 'https://acme-staging-v02.api.letsencrypt.org/acme/chall/172971744/15063525894/fG1TOw',
      status: 'pending',
      token: '4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY'
    },
    location: 'https://acme-staging-v02.api.letsencrypt.org/acme/chall/172971744/15063525894/fG1TOw'
  },
  nonce: 'jDZhkUVkOwDcuxJVrlC8zIma1tMxLgEUW6ejHPQUvj-qRLtcebc'
}
HTTP-01 ACME Challenge
token Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c
HTTP-01 ACME Challenge Answered Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY
HTTP-01 ACME Challenge Answered 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c
HTTP-01 ACME Challenge Answered Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY
HTTP-01 ACME Challenge Answered 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c
HTTP-01 ACME Challenge Answered Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY
HTTP-01 ACME Challenge Answered 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c
HTTP-01 ACME Challenge Answered Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c
HTTP-01 ACME Challenge Answered Zr5hOIDuJgfECeKOwGyg15aqIW8_tgw9OCq_rO-0q2c.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY
HTTP-01 ACME Challenge Answered 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
HTTP-01 ACME Challenge
token 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY
HTTP-01 ACME Challenge Answered 4ZYAKkH-DoFZ_Qua71BH61H0Jt5LQwIVhCRULjG39XY.Ar2gQQ_9DPnGbH_Vd9GfO4Da46YH5F3ayKYIVJ9uYKo
{
  answer: {
    order: {
      status: 'ready',
      expires: '2024-12-01T12:19:35Z',
      identifiers: [Array],
      authorizations: [Array],
      finalize: 'https://acme-staging-v02.api.letsencrypt.org/acme/finalize/172971744/20752839194'
    },
    location: 'https://acme-staging-v02.api.letsencrypt.org/acme/order/172971744/20752839194'
  },
  nonce: 'FW9SwLSL-zEjbBVbU_eGCa0lo5FdDkpM8EqTPfuuOaEKawBZMGA'
}
Ready to Finalize [ 'www.ssl.boats', 'ssl.boats' ]
MIIBCjCBsAIBADAYMRYwFAYDVQQDDA13d3cuc3NsLmJvYXRzMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETs28bb8NKLVHgTV42ZHasXmJ_kQfZorlLVFror3bH3I6qJGjH24BZKq0-Czaq-3wBz2Wt0KteBjmn0lEaDehAaA2MDQGCSqGSIb3DQEJDjEnMCUwIwYDVR0RBBwwGoINd3d3LnNzbC5ib2F0c4IJc3NsLmJvYXRzMAoGCCqGSM49BAMCA0kAMEYCIQCm4GsDtn3yZO9qkm-8kH7vjg4Ekt3mJXo_vU6_amotIgIhAKuC1XfRURd9jNjvWxkqP5AxiyaFeLXMeWKLMPyqKLhd
Waiting for Certificate to be Ready for Download
Next Nonce FW9SwLSLM3Lqzxglc4sRN0vRfl5u2d64Rt6OytqmwHFJsJ8A-Iw
Certificate Ready for Download
Certificate URL: https://acme-staging-v02.api.letsencrypt.org/acme/cert/2bb2ca9735eb23ccf6e2c37620b07a9ea1db
Next Nonce jDZhkUVkCb_0GiSzMNMT5KdRJlGmjzRwNhENUrfrN5XwSkPWz8g
Saved Certificate to file (certificate.pem) - Restart the Server
Saved private key to file (private-key.pem) - Restart the Server