lego go library: No Key ID in JWS header

[udf2457]

I am using the lego go library as part of a Go program I an writing

However I am seeing the following in my logs:

400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/new-order :: urn:ietf:params:acme:error:malformed :: No Key ID in JWS header

Could somebody point me in the right direction as to what I have forgotten to set which means lego is not sending a key ID ? Clearly I am not initialising the lego client correctly, but the docs are not clear.

My program stores a copy of the ACME registration data in a database, which I then feed back in when creating a new client:

func ParseRegistrationDataFromJsonWithConfig(p LegoClientConfig, in string) (*LegoClient, error) {
	l, err := NewClient(p)
	if err != nil {
		return nil, err
	}
	l.LegoUser = &LegoUser{Registration: &registration.Resource{}}
	err = json.Unmarshal([]byte(in), l.LegoUser.Registration)
	if err != nil {
		return nil, err
	}
	return l, nil
}
type LegoClientConfig struct {
	Email      string
	PrivateKey *ecdsa.PrivateKey
	CustomDir  string
	PDNSApi    string
	PDNSUrl    string
}

NewClient() returns a struct:

import (
	"crypto"
	"crypto/ecdsa"

	"github.com/go-acme/lego/v4/lego"
	"github.com/go-acme/lego/v4/registration"
)
type LegoClient struct {
	Client   *lego.Client
	LegoUser *LegoUser
}
type LegoUser struct {
	Email        string
	Registration *registration.Resource
	key          crypto.PrivateKey
}

func (u *LegoUser) GetEmail() string {
	return u.Email
}
func (u LegoUser) GetRegistration() *registration.Resource {
	return u.Registration
}
func (u *LegoUser) GetPrivateKey() crypto.PrivateKey {
	return u.key
}
func NewClient(p LegoClientConfig) (*LegoClient, error) {
	user := LegoUser{
		Email: p.Email,
		key:   p.PrivateKey,
	}
	conf := lego.NewConfig(&user)
	if p.CustomDir != "" {
		conf.CADirURL = p.CustomDir
	}
	client, err := lego.NewClient(conf)
	if err != nil {
		return nil, err
	}
	if p.PDNSApi != "" && p.PDNSUrl != "" {
		cli := &LegoClient{Client: client, LegoUser: &user}
		err = cli.EnablePDNSResolver(p.PDNSApi, p.PDNSUrl)
		if err != nil {
			return nil, err
		}
		return cli, nil
	}
	return &LegoClient{Client: client, LegoUser: &user}, nil
}

[ldez]

Hello,

you should add:

	conf.Certificate = lego.CertificateConfig{
		KeyType: certcrypto.EC256,
		Timeout: time.Duration(30 * time.Second),
	}

[udf2457]

Hello @ldez

Thank you for the suggestion, unfortunately I have just tried it and I get the same error message.

My NewClient() with your suggestion now looks like:

func NewClient(p LegoClientConfig) (*LegoClient, error) {
	user := LegoUser{
		Email: p.Email,
		key:   p.PrivateKey,
	}
	conf := lego.NewConfig(&user)
	if p.CustomDir != "" {
		conf.CADirURL = p.CustomDir
	}
	conf.Certificate = lego.CertificateConfig{
		KeyType: certcrypto.EC256,
		Timeout: time.Duration(30 * time.Second),
	}
	client, err := lego.NewClient(conf)
	if err != nil {
		return nil, err
	}
	if p.PDNSApi != "" && p.PDNSUrl != "" {
		cli := &LegoClient{Client: client, LegoUser: &user}
		err = cli.EnablePDNSResolver(p.PDNSApi, p.PDNSUrl)
		if err != nil {
			return nil, err
		}
		return cli, nil
	}
	return &LegoClient{Client: client, LegoUser: &user}, nil
}

[ldez]

if you want a concrete working example:

lego/cmd/setup.go

Lines 36 to 60 in e508b66

	func newClient(ctx *cli.Context, acc registration.User, keyType certcrypto.KeyType) *lego.Client {
	config := lego.NewConfig(acc)
	config.CADirURL = ctx.String("server")
	config.Certificate = lego.CertificateConfig{
	KeyType: keyType,
	Timeout: time.Duration(ctx.Int("cert.timeout")) * time.Second,
	}
	config.UserAgent = getUserAgent(ctx)
	if ctx.IsSet("http-timeout") {
	config.HTTPClient.Timeout = time.Duration(ctx.Int("http-timeout")) * time.Second
	}
	client, err := lego.NewClient(config)
	if err != nil {
	log.Fatalf("Could not create client: %v", err)
	}
	if client.GetExternalAccountRequired() && !ctx.IsSet("eab") {
	log.Fatal("Server requires External Account Binding. Use --eab with --kid and --hmac.")
	}
	return client
	}

Maybe you have a problem with your private key.

[udf2457]

I thought maybe, but then with Go its hard to go wrong with key generation ?

It was generated with

key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

That's right, no ?

[orange-juzipi]

err = json.Unmarshal([]byte(in), l.LegoUser.Registration)
if err != nil {
	return nil, err
}

Don't use it, use this: https://go-acme.github.io/lego/usage/library/index.html

// New users will need to register
reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
if err != nil {
	log.Fatal(err)
}
l.LegoUser.Registration = reg