From one client ACME developer to another: have you considered just letting the CA return errors, rather than trying to anticipate them? Like, you don't have to know whether something will work. Just try it; it should make the client logic much simpler. CAs will all have slightly different policies and implementations, I figure as long as you handle errors well that's the only complexity you need to worry about.
try
{
}
catch
{
}
finally
{
}
I'm finally nearing completion of the total overhaul of my former ACME client.
nbsp's are not my friend right now...
[^\w \n(){}\[\]'"#\\@!$&%.^~?=;/,+\|<>*:-]
I don't want to use
-mand I don't want to use--install.
I'm totally with you on this.
For Let's E certs, I've been using acme.sh for years. The one thing is, I'm running my own fork which I yank out all install-related things. I fail to understand why any of these ACME-clients want to touch my Nginx configs and all of them do that without asking me first. Zero trust here.
It's not required to use -m or --install. I was just showing the example steps.
Do whatever you want. but if you don't follow my steps, it doesn't make any help to your problems.
I was trying to use the EAB options (from the example on your Wiki), which are an alternative to the -m option. However, using the EAB options, it failed. However, I do want to use the EAB options and not -m. Therefore, your example was, in my specific case, not applicable.
I just tried again with the EAB wiki.
It works as expected.
If you still see errors, please report bugs at github and provide logs with --debug 2.
Thanks.
A lot has changed with the transition from Comodo to Sectigo, and it's inaccurate to say Sectigo is a bad actor based on the actions of Comodo. The CEO you're concerned about stayed behind at Comodo Security Solutions, as did the browser. Meanwhile, Sectigo has taken over the aspects of Comodo's work that benefit the ecosystem at large, like running crt.sh and the Mammoth and Sabre CT logs. They also sponsor Let's Encrypt's CT logs.
I just want to reiterate that @Neilpang is a valued member of our community doing great work, and more ACME clients with more diversity of supported backends is a good thing for our shared mission of encrypting the web.
If I use certbot, this doesn't matter at all, right?
Correct, certbot (currently?) only uses Let's Encrypt as the CA, not any other.
But you can specify the server and eab data to use it for example with ZeroSSL:
--eab-kid "$ZEROSSL_EAB_KID" --eab-hmac-key "$ZEROSSL_EAB_HMAC_KEY" --server "https://acme.zerossl.com/v2/DV90"