ZeroSSL integration failing to create account

[fffonion]

ZeroSSL integration failing to create account

[johnfishbein]

Ah sorry, forgot to close the loop here - your PR #71 fixed the issue for me since I am now able to use my predefined eab credentials. Thanks for your help!

[johnfishbein]

This is the invocation of the lua-resty-acme library that the kong plugin is performing. I hope this helps to provide clarity on my approach.

The kong plugin invokes this acme library as follows:
https://github.com/Kong/kong/blob/master/kong/plugins/acme/client.lua#L108

acme_client, err = acme.new({
    account_email = conf.account_email, -- my email
    account_key = account.key,
    api_uri = url, -- "https://acme.zerossl.com/v2/DV90"
    storage_adapter = storage_full_path,
    storage_config = conf.storage_config[conf.storage],
    eab_kid = conf.eab_kid, -- nil
    eab_hmac_key = conf.eab_hmac_key, -- nil
    -- challenge_start_callback = ... 
    preferred_chain = conf.preferred_chain, -- nil
  })

https://github.com/Kong/kong/blob/master/kong/plugins/acme/client.lua#L129

acme_client:init()
acme_client:new_account()
acme_client:order_certificate(key, host)

[fffonion]

Hi @johnfishbein thanks for the detailed report. It does seem the logic to handle predefined eab crendential is wrong. You can let the library to create it for you at present, you should still be able to see the certs in zerossl dashboars as long as you use the corresponding email to login.

The \/ is json's escape logic, it's same as / when decoded. So I'm not sure how/why zerossl returns this error; my previous experience is that zerossl has some hidden "limits" on the newAccount API, it returns sometimes 500 sometimes others, even though a different acme client is used. But you can try swap the account private key, that seems to clear the "limit".

[johnfishbein]

@fffonion Thanks for your response - I will try swapping the account_key as suggested.

[fffonion]

Closing as inactivity, please reopen if needed : )