[ACME2] : "Failed to read certificate" about acme4j HOT 8 CLOSED

It seems to be a problem with IBM's crypto implementation. According to http://www-01.ibm.com/support/docview.wss?uid=swg21433373 the PEM header is missing or malformed.

You can download your certificate directly from here (e.g. via curl): https://acme-staging-v02.api.letsencrypt.org/acme/cert/fa9a442da786ee5d87ad37d6dd3bbfac22db

If you have a look at the cert, you will see that there are multiple sections in it. You can download it and then try to load it in a test class, e.g.:

try (InputStream in = new FileInputStream("your-cert.csr")) {
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    cf.generateCertificates(in);
}

Then try to alter the csr file in a text editor, and see if you can make it work. My gut feeling is that the IBM implementation has a problem with the empty line between an END CERTIFICATE and the next BEGIN CERTIFICATE.

from acme4j.

I've tried it with OpenJ9, but could not reproduce it. If you find a fix, please let me know.

from acme4j.

Thx for the update. Will look into it tomorrow morning.
BTW. It works with ACME 1 on the same machine.

from acme4j.

In ACME v1, the certificate and intermediates were transmitted in separate resources. It is merged into one resource since ACME v2. This is why I suspect the empty line.

from acme4j.

I have changed the code in class DefaultConnection

` @OverRide
public List readCertificates() throws AcmeException {
assertConnectionIsOpen();
String contentType = AcmeUtils.getContentType(conn.getHeaderField(CONTENT_TYPE_HEADER));
if (!("application/pem-certificate-chain".equals(contentType))) {
throw new AcmeProtocolException("Unexpected content type: " + contentType);
}
try (InputStream in = conn.getInputStream()) {

		StringBuffer sb = new StringBuffer();
		BufferedReader br = new BufferedReader(new InputStreamReader(in, "UTF-8"));
		String line;
		while ((line = br.readLine()) != null) {
			if (line.trim().length() == 0) {
				continue; // Skip blank lines
			} else {
				sb.append(line);
				sb.append("\n");
			}
		}

		br.close();

		ByteArrayInputStream bytes = new ByteArrayInputStream(sb.toString().getBytes("UTF-8"));
		CertificateFactory cf = CertificateFactory.getInstance("X.509");

		return cf.generateCertificates(bytes).stream().map(c -> (X509Certificate) c).collect(toList());
	} catch (IOException ex) {
		throw new AcmeNetworkException(ex);
	} catch (CertificateException ex) {
		throw new AcmeProtocolException("Failed to read certificate", ex);
	}
}`

This does the trick. I guess that there is a more elegant way to remove the blank lines :)

from acme4j.

Allright... I will implement an InputStream filter, to keep the memory footprint small.

from acme4j.

Commit 3f901e9 should fix this problem. Can you give it a try?

from acme4j.

Excellent. That fixes it.

from acme4j.