EJBCA-CE unknown error

[danieldownload]

Hi there,

just trying go get acme working with our ejbca-ca but I'm not able to find the mistake.

This is how far it works:

[Tue Nov 19 12:37:59.191064 2024] [wsgi:error] [pid 18:tid 140605804742208] [remote 192.168.14.10:48466] 192.168.14.10 /acme/chall/zA49O0XgTcmQ {'data': {'type': 'http-01', 'token': '- modified -', 'status': 'valid', 'validated': '2024-11-19T12:37:59Z', 'url': 'http://ejbca-node1.xxx:22280/acme/chall/zA49O0XgTcmQ'}, 'header': {'Link': '<http://ejbca-node1.xxx:22280/acme/authz/>;rel="up"', 'Replay-Nonce': '- modified -'}, 'code': 200}
[Tue Nov 19 12:38:06.576587 2024] [wsgi:error] [pid 18:tid 140605922240064] [remote 192.168.14.10:48468] 192.168.14.10 /acme/order/z06UBuy04jsJ {'header': {'Location': 'http://ejbca-node1.xxx:22280/acme/order/z06UBuy04jsJ', 'Replay-Nonce': '- modified -'}, 'data': {'status': 'ready', 'expires': '2024-11-20T12:37:59Z', 'identifiers': [{'type': 'dns', 'value': 'labsprung.net.xxx'}], 'authorizations': ['http://ejbca-node1.xxx:22280/acme/authz/GFJBMlEuPa84'], 'finalize': 'http://ejbca-node1.xxx:22280/acme/order/z06UBuy04jsJ/finalize'}, 'code': 200}
[Tue Nov 19 12:38:07.013178 2024] [wsgi:error] [pid 18:tid 140605770102336] CAhandler.enroll(): Unknown error
[Tue Nov 19 12:38:07.013349 2024] [wsgi:error] [pid 18:tid 140605770102336] acme2certifier enrollment error: Unknown error
[Tue Nov 19 12:38:07.049087 2024] [wsgi:error] [pid 18:tid 140605804742208] [remote 192.168.14.10:48468] 192.168.14.10 /acme/order/z06UBuy04jsJ/finalize {'code': 500, 'header': {'Replay-Nonce': '- modified -'}, 'data': {'status': 500, 'type': 'urn:ietf:params:acme:error:serverInternal', 'detail': 'enrollment failed'}}

Any idea what the problem can be?

Thx
Daniel

[grindsa]

It seems that the status check towards EJBCA fails. Unfortunately, the logging of this error is incomplete and needs a bid of improvement.

Can you pls describe your deployment (which acme2certifier, rpm/deb/containerized) a bid more in detail?
Can you please enable debuging (set debug: True) in acme_srv.cfg trigger the issue and share the logs along with your acme_srv.cfg?

You can also share via email to [email protected]

[grindsa]

I opened the issue #192 for this. Can we please continue the discussion there?