acmesh-official / acmesh-official/acme.sh

Can't renew ec-384 certificate after enabling FIPS mode.

Abierto
#6,300 8 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Shell
Estrellas
47.6k
Forks
5.7k
Merge medio
6 d 5 h
PR fusionados (30 d)
15

Descripción

On my Rocky Linux 9.5, we can no longer renew our certificates from letsencrypt after we enabled FIPS mode:

```
[Fri Apr 11 20:57:15 UTC 2025] EC key
[Fri Apr 11 20:57:15 UTC 2025] Let's try ASN1 OID
[Fri Apr 11 20:57:15 UTC 2025] ECC oid:
[Fri Apr 11 20:57:15 UTC 2025] Error creating new order.
[Fri Apr 11 20:57:15 UTC 2025] pid
[Fri Apr 11 20:57:15 UTC 2025] No need to restore nginx config, skipping.
[Fri Apr 11 20:57:15 UTC 2025] _clearupdns
[Fri Apr 11 20:57:15 UTC 2025] dns_entries
[Fri Apr 11 20:57:15 UTC 2025] Skipping dns.
[Fri Apr 11 20:57:15 UTC 2025] _on_issue_err
[Fri Apr 11 20:57:15 UTC 2025] Please add '--debug' or '--log' to see more information.
[Fri Apr 11 20:57:15 UTC 2025] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

```

This doesn't seem to be an issue with openssl ... was able to successfully generate a new key and csr locally without it barfing. Running this version:

```
# acme.sh version
https://github.com/acmesh-official/acme.sh
v3.1.1
```

I have certs that are going to expire in a couple of days... so this is urgent for me personally...

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Reproduce on Rocky Linux with FIPS enabled using the same acme.sh version and EC-384 renewal command, then rerun with --debug or --log to capture full output. Start by reading the main acme.sh script and follow the renewal flow to the new-order creation path where the failure appears. Compare behavior in normal and FIPS modes, and consider it done when an order is created and renewal succeeds without the "Error creating new order" message.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
linux, shell
Área
cli, security
Tipo de issue
Error
Dificultad
3/5
Tiempo estimado
1-2 días
Estado de actividad
Tranquilo
Claridad
Bastante claro
Aptitud para principiantes
56/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.