Issue using this with zerossl

[saucetrey]

Hi thanks so much for this!

I have an issue trying to deploy this in Azure and using it with zerossl.

1.) I've verified IAM permissions for the resource groups required.
2.) Azure DNS is configured, IAM permissions granted and added Application Configuration for Acmebot:AzureDns:SubscriptionId
3.) For ZeroSSL since it requires EAB; I added Acmebot:ExternalAccountBinding:Algorithm(tried HS256 and HS384), configured Acmebot:ExternalAccountBinding:HmacKey, and Acmebot:ExternalAccountBinding:KeyId. The Acmebot:Endpoint is https://acme.zerossl.com/v2/DV90/.

When I try to issue a new certificate I get this

"Orchestrator function 'AddCertificate_Orchestrator' failed: The orchestrator function 'IssueCertificate' failed: "The activity function 'UploadCertificate' failed: "missing header: Replay-Nonce". See the function execution logs for additional details.". See the function execution logs for additional details."

Function 'UploadCertificate (Activity)' failed with an error. Reason: System.Exception: missing header: Replay-Nonce
at ACMESharp.Protocol.AcmeProtocolClient.ExtractNextNonce(HttpResponseMessage resp, Boolean skipThrow)
at ACMESharp.Protocol.AcmeProtocolClient.SendAcmeAsync(Uri uri, HttpMethod method, Object message, HttpStatusCode[] expectedStatuses, Boolean skipNonce, Boolean skipSigning, Boolean includePublicKey, CancellationToken cancel, String opName)
at ACMESharp.Protocol.AcmeProtocolClient.GetAsync(String relativeUrl, CancellationToken cancel)
at AppService.Acmebot.Internal.AcmeProtocolClientExtensions.GetOrderCertificateAsync(AcmeProtocolClient acmeProtocolClient, OrderDetails order, String preferredChain, CancellationToken cancel) in /home/runner/work/appservice-acmebot/appservice-acmebot/AppService.Acmebot/Internal/AcmeProtocolClientExtensions.cs:line 20
at AppService.Acmebot.Functions.SharedActivity.UploadCertificate(ValueTuple5 input) in /home/runner/work/appservice-acmebot/appservice-acmebot/AppService.Acmebot/Functions/SharedActivity.cs:line 504 at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker2.InvokeAsync(Object instance, Object[] arguments) in C:\projects\azure-webjobs-sdk-rqm4t\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionInvoker.cs:line 52

Renewing also doesn't seem to work.

Any assistance you might be able to provide?

Thank you!

[shibayan]

Thanks for the report. This was a bug in Acmebot.

I was able to reproduce it in my environment, and a fix will be released soon.

[shibayan]

Fixed in v3.4.10. Thanks again.

[saucetrey]

Thank you, validated on my side as well that it fixed it.

[saucetrey]

One other question if you don't mind. Trying to test renewing an existing zerossl cert, I ran the renewtimer function, and it's not renewing an existing zerossl cert; should it? I see this event in the transactions from renewcertificates_orchestrator; "Certificates are not found"

[saucetrey]

Nevermind just saw your reply to something else "Only certificates issued by Acmebot will be processed for renewal approximately 30 days in advance.Renewals are only processed on Mondays, Wednesdays, and Fridays, so it's not always 30 days in advance."

It wasn't issued by acmebot so it makes sense it isnt finding any.

Thanks for all of your help!