Comments (8)
It seems to be a problem with IBM's crypto implementation. According to http://www-01.ibm.com/support/docview.wss?uid=swg21433373 the PEM header is missing or malformed.
You can download your certificate directly from here (e.g. via curl
): https://acme-staging-v02.api.letsencrypt.org/acme/cert/fa9a442da786ee5d87ad37d6dd3bbfac22db
If you have a look at the cert, you will see that there are multiple sections in it. You can download it and then try to load it in a test class, e.g.:
try (InputStream in = new FileInputStream("your-cert.csr")) {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
cf.generateCertificates(in);
}
Then try to alter the csr file in a text editor, and see if you can make it work. My gut feeling is that the IBM implementation has a problem with the empty line between an END CERTIFICATE
and the next BEGIN CERTIFICATE
.
from acme4j.
I've tried it with OpenJ9, but could not reproduce it. If you find a fix, please let me know.
from acme4j.
Thx for the update. Will look into it tomorrow morning.
BTW. It works with ACME 1 on the same machine.
from acme4j.
In ACME v1, the certificate and intermediates were transmitted in separate resources. It is merged into one resource since ACME v2. This is why I suspect the empty line.
from acme4j.
I have changed the code in class DefaultConnection
` @OverRide
public List readCertificates() throws AcmeException {
assertConnectionIsOpen();
String contentType = AcmeUtils.getContentType(conn.getHeaderField(CONTENT_TYPE_HEADER));
if (!("application/pem-certificate-chain".equals(contentType))) {
throw new AcmeProtocolException("Unexpected content type: " + contentType);
}
try (InputStream in = conn.getInputStream()) {
StringBuffer sb = new StringBuffer();
BufferedReader br = new BufferedReader(new InputStreamReader(in, "UTF-8"));
String line;
while ((line = br.readLine()) != null) {
if (line.trim().length() == 0) {
continue; // Skip blank lines
} else {
sb.append(line);
sb.append("\n");
}
}
br.close();
ByteArrayInputStream bytes = new ByteArrayInputStream(sb.toString().getBytes("UTF-8"));
CertificateFactory cf = CertificateFactory.getInstance("X.509");
return cf.generateCertificates(bytes).stream().map(c -> (X509Certificate) c).collect(toList());
} catch (IOException ex) {
throw new AcmeNetworkException(ex);
} catch (CertificateException ex) {
throw new AcmeProtocolException("Failed to read certificate", ex);
}
}`
This does the trick. I guess that there is a more elegant way to remove the blank lines :)
from acme4j.
Allright... I will implement an InputStream
filter, to keep the memory footprint small.
from acme4j.
Commit 3f901e9 should fix this problem. Can you give it a try?
from acme4j.
Excellent. That fixes it.
from acme4j.
Related Issues (20)
- The challenge status was always "INVALID" HOT 13
- http://${domain}/.well-known/acme-challenge/${token}
- acme4j example is creating zero- length crt files HOT 10
- preferred-chain attribute, for alternate chains HOT 2
- Can only parse traditional files HOT 2
- EAB HMAC keys with arbitrary lengths HOT 5
- CVE-2023-33201 from Bouncy Castle HOT 8
- add utils to do pre validation or help HOT 1
- How to check if certificate needs renewal without ordering a new one? HOT 8
- Is there a way to keep txt unchanged and verify twice? HOT 2
- New account registration HOT 2
- Bouncy Castel dependency? HOT 9
- Allow to pass query parameters in directory URL HOT 2
- Provide example showing how to save and load existing certificates HOT 2
- AcmeJsonResource#update throws AcmeRetryAfterException even if resource is ready HOT 4
- Abstract away certificate renewal HOT 6
- response is not reading correctly HOT 3
- Java 22 Support HOT 1
- OrderBuilder.replaces() functions assume auto-renewal support by the server HOT 3
- The request attempted to finalize an order that is not ready to be finalized HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from acme4j.