I'm following the readme and when I start up the python webserver this happens (There'

I did some tests, and it seems that the n key of <cod

I <a href="https://github.com/letsencrypt/letsencrypt/issues/1984" data-hovercard-type

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

acme-v01.api.letsencrypt.org says "Unable to read/verify body :: JWS verification error" about acme-nosudo HOT 13 CLOSED

diafygi commented on July 21, 2024

acme-v01.api.letsencrypt.org says "Unable to read/verify body :: JWS verification error"

from acme-nosudo.

Comments (13)

mlocati commented on July 21, 2024

I have the same problem.

I tested letsencrypt-nosudo with Boulder too (run letsencrypt/tests/boulder-start.sh to start it).

Here's the output of Boulder log:

09:39:36 boulder-wfe Successful request JSON={"ID":"J6011G2LSsQMR1E1jgDKEDdfRoAhI_lqgvS06f1zgbc","ClientAddr":"[::1]:38639","Endpoint":"/directory","Method":"HEAD","RequestTime":"2015-12-21T09:39:36.386919847+01:00","ResponseTime":"2015-12-21T09:39:36.386941368+01:00","Errors":null}
09:39:36 boulder-wfe Successful request JSON={"ID":"snkb5VAv3SlHaquLokEIoe5E8_ZogDPCmQy1yU-LfSk","ClientAddr":"[::1]:38640","Endpoint":"/directory","Method":"HEAD","RequestTime":"2015-12-21T09:39:36.388670282+01:00","ResponseTime":"2015-12-21T09:39:36.388678413+01:00","Errors":null}
09:39:36 boulder-wfe Successful request JSON={"ID":"VIXj4uD04MUQmVeFcpI0rwMHGcDvYcst6LIuZ6T2OJs","ClientAddr":"[::1]:38641","Endpoint":"/directory","Method":"HEAD","RequestTime":"2015-12-21T09:39:36.397550542+01:00","ResponseTime":"2015-12-21T09:39:36.397559818+01:00","Errors":null}
09:39:41 boulder-wfe  [c>][WFE->SA.u.d55357] requesting GetRegistrationByKey({"kty":"RSA","n":"2wyEGG2jrBReBW6VMVNv3I-uP2wTPyswSClA5QbsaButQnZgxGUPiLRrqD-isy1nPO2y-gEiVC9DJ-rHNaijAfj_mN9SUBMiV2ooTcgBu4KBNC6zWcBDzCxFVPgptuXAoiHG88A3faNkHwq6U5CLiXgkROXZithRHPEP5B2dDXFTFAbTcuooZ1hx0T_16j218ZOfR9yiSjWxuy1ZbJ925DDnpUD_X-DZUTmktYQZpXi41ieIc_cUeI53V0Q_YyqhSBS_E3cD8VkkkK0pVFuCkJResXowOy0ZXlcu8I7aiq1dAwwagGB6FHhzMQJc-ZK6e8NciPC6iKB36DnxDHpgheq3CFjbul7p8L2Ip9OyPHixvFOhq7HGiRmRTzl3bNUo-F0hO25HdiiPpN1cCzRY-q4ZD-MOkGvPG5AJViP3qW5kcDxFoChU--ilZ1hcsyEuD26Q6Pg_mvRu4bnGNhmMG_OK08EZuoO0oNaeaIIR6by4kruJwfe2Z8X87LwgHyhHVbYylnowz5ZPy4DHPMrZhkmCl_eU4OxfRnVDXJd_mz63tlGAxpF-tMEbDfrc5bjzZnF_fWCqmfnv8rIg3UO0BsP7nriDyrGwBP5-uJqt6kF7n7fWkugWOa8NF9_vTAo0fmqSb7FXTbJWsFbzQHizsrfIuALO5YI8iVFySSHrem8","e":"AQAB"}) [QZTAux4uMq4]
09:39:41 activity-monitor MONITOR: {"Acknowledger":{},"Headers":null,"ContentType":"","ContentEncoding":"","DeliveryMode":0,"Priority":0,"CorrelationId":"QZTAux4uMq4","ReplyTo":"WFE-\u003eSA.u.d55357","Expiration":"30000","MessageId":"","Timestamp":"2015-12-21T09:39:41+01:00","Type":"GetRegistrationByKey","UserId":"","AppId":"","ConsumerTag":"boulder","MessageCount":0,"DeliveryTag":1,"Redelivered":false,"Exchange":"boulder","RoutingKey":"SA.server","Body":"eyJrdHkiOiJSU0EiLCJuIjoiMnd5RUdHMmpyQlJlQlc2Vk1WTnYzSS11UDJ3VFB5c3dTQ2xBNVFic2FCdXRRblpneEdVUGlMUnJxRC1pc3kxblBPMnktZ0VpVkM5REotckhOYWlqQWZqX21OOVNVQk1pVjJvb1RjZ0J1NEtCTkM2eldjQkR6Q3hGVlBncHR1WEFvaUhHODhBM2ZhTmtId3E2VTVDTGlYZ2tST1haaXRoUkhQRVA1QjJkRFhGVEZBYlRjdW9vWjFoeDBUXzE2ajIxOFpPZlI5eWlTald4dXkxWmJKOTI1RERucFVEX1gtRFpVVG1rdFlRWnBYaTQxaWVJY19jVWVJNTNWMFFfWXlxaFNCU19FM2NEOFZra2tLMHBWRnVDa0pSZXNYb3dPeTBaWGxjdThJN2FpcTFkQXd3YWdHQjZGSGh6TVFKYy1aSzZlOE5jaVBDNmlLQjM2RG54REhwZ2hlcTNDRmpidWw3cDhMMklwOU95UEhpeHZGT2hxN0hHaVJtUlR6bDNiTlVvLUYwaE8yNUhkaWlQcE4xY0N6UlktcTRaRC1NT2tHdlBHNUFKVmlQM3FXNWtjRHhGb0NoVS0taWxaMWhjc3lFdUQyNlE2UGdfbXZSdTRibkdOaG1NR19PSzA4RVp1b08wb05hZWFJSVI2Ynk0a3J1SndmZTJaOFg4N0x3Z0h5aEhWYll5bG5vd3o1WlB5NERIUE1yWmhrbUNsX2VVNE94ZlJuVkRYSmRfbXo2M3RsR0F4cEYtdE1FYkRmcmM1Ymp6Wm5GX2ZXQ3FtZm52OHJJZzNVTzBCc1A3bnJpRHlyR3dCUDUtdUpxdDZrRjduN2ZXa3VnV09hOE5GOV92VEFvMGZtcVNiN0ZYVGJKV3NGYnpRSGl6c3JmSXVBTE81WUk4aVZGeVNTSHJlbTgiLCJlIjoiQVFBQiJ9"}
09:39:41  boulder-sa  [s<][SA.server][WFE->SA.u.d55357] received GetRegistrationByKey({"kty":"RSA","n":"2wyEGG2jrBReBW6VMVNv3I-uP2wTPyswSClA5QbsaButQnZgxGUPiLRrqD-isy1nPO2y-gEiVC9DJ-rHNaijAfj_mN9SUBMiV2ooTcgBu4KBNC6zWcBDzCxFVPgptuXAoiHG88A3faNkHwq6U5CLiXgkROXZithRHPEP5B2dDXFTFAbTcuooZ1hx0T_16j218ZOfR9yiSjWxuy1ZbJ925DDnpUD_X-DZUTmktYQZpXi41ieIc_cUeI53V0Q_YyqhSBS_E3cD8VkkkK0pVFuCkJResXowOy0ZXlcu8I7aiq1dAwwagGB6FHhzMQJc-ZK6e8NciPC6iKB36DnxDHpgheq3CFjbul7p8L2Ip9OyPHixvFOhq7HGiRmRTzl3bNUo-F0hO25HdiiPpN1cCzRY-q4ZD-MOkGvPG5AJViP3qW5kcDxFoChU--ilZ1hcsyEuD26Q6Pg_mvRu4bnGNhmMG_OK08EZuoO0oNaeaIIR6by4kruJwfe2Z8X87LwgHyhHVbYylnowz5ZPy4DHPMrZhkmCl_eU4OxfRnVDXJd_mz63tlGAxpF-tMEbDfrc5bjzZnF_fWCqmfnv8rIg3UO0BsP7nriDyrGwBP5-uJqt6kF7n7fWkugWOa8NF9_vTAo0fmqSb7FXTbJWsFbzQHizsrfIuALO5YI8iVFySSHrem8","e":"AQAB"}) [QZTAux4uMq4]
09:39:41  boulder-sa SQL:  SELECT * FROM registrations WHERE jwk_sha256 = ? [1:"DNO3d+4C1xE3lphV0tyKywGmDssCrv6mTKj4EpHleL0="]
09:39:41  boulder-sa  [s>][SA.server][WFE->SA.u.d55357] replying GetRegistrationByKey: , RPCERR: &{No registrations with public key sha256 DNO3d+4C1xE3lphV0tyKywGmDssCrv6mTKj4EpHleL0= NoSuchRegistrationError 0} [QZTAux4uMq4]
09:39:41 activity-monitor MONITOR: {"Acknowledger":{},"Headers":null,"ContentType":"","ContentEncoding":"","DeliveryMode":0,"Priority":0,"CorrelationId":"QZTAux4uMq4","ReplyTo":"","Expiration":"30000","MessageId":"","Timestamp":"2015-12-21T09:39:41+01:00","Type":"GetRegistrationByKey","UserId":"","AppId":"","ConsumerTag":"boulder","MessageCount":0,"DeliveryTag":2,"Redelivered":false,"Exchange":"boulder","RoutingKey":"WFE-\u003eSA.u.d55357","Body":"eyJyZXR1cm5WYWwiOm51bGwsImVycm9yIjp7InZhbHVlIjoiTm8gcmVnaXN0cmF0aW9ucyB3aXRoIHB1YmxpYyBrZXkgc2hhMjU2IEROTzNkKzRDMXhFM2xwaFYwdHlLeXdHbURzc0NydjZtVEtqNEVwSGxlTDA9IiwidHlwZSI6Ik5vU3VjaFJlZ2lzdHJhdGlvbkVycm9yIn19"}
09:39:41 boulder-wfe  [c<][WFE->SA.u.d55357] response GetRegistrationByKey: , RPCERR: &{No registrations with public key sha256 DNO3d+4C1xE3lphV0tyKywGmDssCrv6mTKj4EpHleL0= NoSuchRegistrationError 0} [QZTAux4uMq4]
09:39:41 boulder-wfe Terminated request JSON={"ID":"ScagzfzWKPOrPpToNnWh9OLE3cf0R8I4PGwQ_szlwUs","ClientAddr":"[::1]:38642","Endpoint":"/acme/new-reg","Method":"POST","RequestTime":"2015-12-21T09:39:41.82590821+01:00","ResponseTime":"2015-12-21T09:39:41.833769435+01:00","Errors":["verification of JWS with the JWK failed: square/go-jose: error in cryptographic primitive; body: {\n    \"header\": {\n        \"alg\": \"RS256\", \n        \"jwk\": {\n            \"e\": \"AQAB\", \n            \"k","400 :: urn:acme:error:malformed :: JWS verification error"]}

from acme-nosudo.

mlocati commented on July 21, 2024

PS: in order to use Boulder instead of official letsencrypt server you have to change sign_csr.py by setting CA = "http://localhost:4000"

from acme-nosudo.

mlocati commented on July 21, 2024

I did some tests, and it seems that the n key of jwk is different from the one generated by the official letsencrypt client.

For instance, let's take this private key:

The letsencrypt client generates this header:

{
  "alg": "RS256",
  "jwk": {
    "e": "AQAB",
    "kty": "RSA",
    "n": "q2C-WauK718BJ2nIzw1465dFJwCnwHIbTUCMhHX_2uNbRYGZMNQ10trPvXljQWq1mBMBoRaIjnnqKUoVO6muSCi-6cC2jvLz20zzVmWfbMt1cdfJQeeCMkTwV-Zay1Pp9F7mMhXGWtfhnQ7YLvgEEKowxhrkiXnLgAVh_q8837pjIvSuID_UtCfL6utJkZ2ukeOwLYu7f4wSZm9r0qEmlo7Sn9CyaET523O0oGBfA-CVid8UJ7GvC66wbnVeY_jd7kQzIplHhy-oltSqAG_INSKpf29_9gtGdDPzv9d7BAsrRcQwVT_Vvpbx8DRe6WUfgvwb4RR-hZ6xSH0YrJsPAQ",
  }
}

but letsencrypt-nosudo generates this header:

{
  "alg": "RS256",
  "jwk": {
    "e": "AQAB",
    "kty": "RSA",
    "n": "tpW0eROWQMZsUVpyFirz7YtD7CbVkDEh_XQo66zXJey29lSnosouN_jeJ1xc9pvPvj5Mp28I-w95nvST_6JHVGP00lKE9UItDNPpEUk4B_0rxiOktxhTcdk0LMYOGWD-dylpCaGpTI_3yViD8hpGmYzdXM9XHIftU0xYfgqmVgEZjb3pAkZbEFqw8z_l9FrWXxnjGPviPTz0c3eLQKbFGzOn6JEBhMBhS-B6IhrZCXnHfAVqfmfoGtq5XU_xZqhCBNnUxmra2-RJBBRr2YTNQDm82tGMbdH7lkyOvex1fKhoSt2WCFdStvpyljkX1U8lv44ERJ0_gg1g7G1D0YqaLw",
  }
}

from acme-nosudo.

mlocati commented on July 21, 2024

I filed an issue in the official letsencrypt repository, let's see...

from acme-nosudo.

diafygi commented on July 21, 2024

@igniferroque no, signature should not be blank. This usually happens when the signature command didn't run correctly. Did you run the commands after STEP 3: You need to sign some more files (replace 'user.key' with your user private key).?

@mlocati a different public key shouldn't cause a blank signature, so your issue might be a different one. Please file another bug if you see a value in the signature field in the json payload.

from acme-nosudo.

diafygi commented on July 21, 2024

@mlocati When I tried using your public key in letsencrypt-nosudo, I got the same jwk as letsencrypt.

{
    "alg": "RS256", 
    "jwk": {
        "e": "AQAB", 
        "kty": "RSA", 
        "n": "q2C-WauK718BJ2nIzw1465dFJwCnwHIbTUCMhHX_2uNbRYGZMNQ10trPvXljQWq1mBMBoRaIjnnqKUoVO6muSCi-6cC2jvLz20zzVmWfbMt1cdfJQeeCMkTwV-Zay1Pp9F7mMhXGWtfhnQ7YLvgEEKowxhrkiXnLgAVh_q8837pjIvSuID_UtCfL6utJkZ2ukeOwLYu7f4wSZm9r0qEmlo7Sn9CyaET523O0oGBfA-CVid8UJ7GvC66wbnVeY_jd7kQzIplHhy-oltSqAG_INSKpf29_9gtGdDPzv9d7BAsrRcQwVT_Vvpbx8DRe6WUfgvwb4RR-hZ6xSH0YrJsPAQ"
    }
}

from acme-nosudo.

InvisibleFunction commented on July 21, 2024

I copied all the referenced .json files to the machine where my private key is, ran the commands, then copied all the generated .sig files back to the same directory. I believe that's all that is required.

from acme-nosudo.

diafygi commented on July 21, 2024

I believe if you overwrite a named temporary file with a new file, the named temporary file object in python would have closed (causing the empty file). Can you please try writing the .sig file output directly to the open temporary files, rather than copying and overwriting them?

from acme-nosudo.

mlocati commented on July 21, 2024

I swapped the values of n here. The correct values of my test are the one reported at certbot/certbot#1984
(letsencrypt-nosudo generates the q2C... and official letsencrypt seems to generate tpW...).

from acme-nosudo.

onur commented on July 21, 2024

I was getting same error, make sure you run openssl commands when program asks for it. This fixed the issue for me and everything is running fine.

from acme-nosudo.

diafygi commented on July 21, 2024

@igniferroque assuming you have resolved your issue.

from acme-nosudo.

InvisibleFunction commented on July 21, 2024

Sorry, I haven't gotten back to you. I hope to have some time to try this again this weekend. Thanks for your help!

from acme-nosudo.

InvisibleFunction commented on July 21, 2024

Overwriting the files with redirection (>) didn't work and I suppose I should have tried to append to them (>>) but I just copied my user.key to the server and did it that way which worked fine.
Thanks!

from acme-nosudo.

acme-v01.api.letsencrypt.org says "Unable to read/verify body :: JWS verification error" about acme-nosudo HOT 13 CLOSED

Comments (13)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent