[Bug]: urn:ietf:params:acme:error:rejectedIdentifier #2026
Comments
|
I am requesting a new certificate for |
|
EDIT: I've added additional logs to the original post. It shows that the requested identifier is equal to |
|
Another thing that seems off is that the server response is HTTP 200 and |
Did your ACME client update the DNS with the correct challenge value?
This is how the ACME protocol works. Challenges are solved asynchronously, so the status is in fact pending. |
Yes. I update the DNS (hosted on Cloudflare in my case) and waited for the local machine to see the change. I then fired the challenge. Given that the server is running on the same machine as the client, I expected the challenge to succeed immediately... but it didn't. A whopping 7 minutes later, step-ca finally sees the changes. Any idea why it's taking so long? The next problem is that the generated certificate is missing a #302 seems to be loosely related, but I can't figure out why the |
Well, it's DNS, so there may be some caching going on 😅 Go would use the system DNS to resolve the domain. You can try the
You can use the |
|
Subject Alternative Names or SANs are where the domain names should be. The subject common name is deprecated but is still widely used to identify a certificate. The ACME provisioner has the |
|
Oh, I see. That changes things. So if I understand you correctly, all domains get dumped into Subject Alternative Names (regardless of their order) and are given equal weight? |
It's not so much "giving a weight". They're basically (alternative) names for "the thing" that has the private key for the cert. SANs have a stronger type definition than the Subject as a whole or just its Common Name, which makes reasoning about certificate chain validation more well defined, a.o. |
Thanks for reminding me... When I poll the DNS locally waiting for a change, I explicitly disable the use of the DNS cache. Does |
|
I'm going to try migrating to the http-01 challenge. Hopefully it'll be a lot faster... |
|
Circling back, I guess you can close this issue now. Thank you. |
|
Thank you for notifying, @cowwoc 🙂 |
Steps to Reproduce
Use acme4j to order a new certificate using the dns-01 challenge
Your Environment
Microsoft Windows [Version 10.0.19045.4894]step-caVersion -Expected Behavior
Certificate is issued
Actual Behavior
step-ca outputs this error:
time="2024-10-08T12:59:30-04:00" level=info duration=1.0271ms duration-ns=1027100 fields.time="2024-10-08T12:59:30-04:00" method=POST name=ca nonce=SkdUMHRub1QxMndoWXJKalJYS2pIRk9wQzZ6ZU16T1E path=/acme/acme/challenge/5IFqsjAzUsVgY56A8CjuMAUxsTNImrIJ/xjMtBtRnU7tq5kpcrrYTBnrBYx1vk65V protocol=HTTP/2.0 referer= remote-address=127.0.0.1 request-id=b17f453a-ce71-4725-aef9-94036052c933 response="{\"type\":\"dns-01\",\"status\":\"pending\",\"token\":\"B1jB3SkzIrqHrbkicDzz4kMVlpM5hVdF\",\"url\":\"https://127.0.0.1:307/acme/acme/challenge/5IFqsjAzUsVgY56A8CjuMAUxsTNImrIJ/xjMtBtRnU7tq5kpcrrYTBnrBYx1vk65V\",\"error\":{\"type\":\"urn:ietf:params:acme:error:rejectedIdentifier\",\"detail\":\"The server will not issue certificates for the identifier\"}}" size=330 status=200 user-agent="acme4j/3.4.0 Java/22.0.2" user-id=Additional Context
Here is the debug log from acme4j:
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: