ACMEv2: CSR with single CN (no SANs) rejected #3367
Comments
|
NOTE: when the single domain is included in the SubjectAltName, ACMEv2 works fine: |
|
Hi @diafygi, The root issue here is that your CSR only has a legacy subject common name, and no DNS type SAN entries. If you finalize the order with a CSR that has a DNS SAN for I think given what you've shown with the V1 API being more tolerant of this we should probably promote the Subject CN to a SAN in the V2 API (or at least fix the error message to be more descriptive of the root cause!). I'm going to close this issue in favour of one to do that: #3368 Thanks for reporting this! I appreciate it. |
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this issue
Sep 8, 2018
- Make regular expression accept a whitespace after CN. - Don't fail on openssl 1.1 output - Add documentation and support for Red Hat openssl directories - fix parsing of new (?) openssl output format - Fix broken Markdown headings - FIX CN parsing to work with OpenSSL 1.1 - Make acme_tiny.py executable in index - Minor tweak that makes deploying a tiny bit easier - OpenSSL output seems to have changed another time. - fixed changing error message - fixed more error message case changes - Fix typos - switched to grabbing the agreement url from /directory, addresses #145, #148, #172, #189 - damn python3 bytes-to-strings encoding gets you again... - added python 3.6 to test coverage - update SSL config - mostly working ACMEv2, except for letsencrypt/boulder#3367 - deprecated CA url in favor of using the direct certificate authority directory url - added badNonce retries - consolidated external commandline execution error handling to bring back under 200 lines of code - removed challenge payload that is no longer needed in new acme spec - updated test coverage to ignore new setup.py file (setup install still gets tested via test_install.py) - updated readme to note that ACME v2 certificate downloads now include the intermediate certificate - added optional contact details - fixed buffer to unicode decoding for tests - cleaned up help and copyright text - Readme: Only needs access to private account key - added tiny user agent - don't skip ValueError when urlopen(Request(nonvalid, ...))
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Given the below CSR[1][2], ACMEv2 /finalize-order rejects for the reason "Order includes different number of names than CSR specifies"[3]. However, this same CSR is not rejected on ACMEv1[4].
[1]:
[2]:
[3]:
[4]:
The text was updated successfully, but these errors were encountered: