ERROR acme: error: 500 :: POST renewing with v4.16.0 --- v4.15.0 is OK

[stefanomarty]

ERROR acme: error: 500 :: POST renewing with v4.16.0 --- v4.15.0 is OK

[beautifulentropy]

🤔 feel related to ARI, @beautifulentropy maybe you can help us?

• https://github.com/letsencrypt/boulder/blob/7d633c6e781ba891192f78745720750195f897b6/wfe2/wfe.go#L2321
• https://github.com/letsencrypt/boulder/blob/7d633c6e781ba891192f78745720750195f897b6/wfe2/wfe.go#L2217

Thanks for bringing this to our attention. This one is our fault. We need to make a slight adjustment to our production configuration. I'll post once we have this fixed.

[ldez]

🤔 feel related to ARI, @beautifulentropy maybe you can help us?

• https://github.com/letsencrypt/boulder/blob/7d633c6e781ba891192f78745720750195f897b6/wfe2/wfe.go#L2321
• https://github.com/letsencrypt/boulder/blob/7d633c6e781ba891192f78745720750195f897b6/wfe2/wfe.go#L2217

[stefanomarty]

Not now, sorry :-(((
I can probably give a try tomorrow afternoon (UTC+1 here :-)

[ldez]

I found a fix #2138 for users who don't use ARI but the problem is still here.
I created a release v4.6.1

[beautifulentropy]

The configuration issue has been resolved.

[ldez]

@stefanomarty can we try to bisect the problem?
Can you try the following commits?

• 82e9a5e
• adea063
• 6dd8d03

[ldez]

I bisected the problem and it's related to 6dd8d03 (#2114) as I suspected.
The problem is related to ARI.

The problem is related to the validateReplacementOrder letsencrypt/boulder#7298, but I don't know the reason.

It doesn't seem related to MakeARICertID/parseCertID 🤔