gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-13 01:39:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: wire ACME EAB into account registration + ZeroSSL auto-fetch

Browse Source 
EAB credentials (KID + HMAC) were defined in the ACME connector config
but never wired into the acme.Account registration call. This fixes the
dead code and adds automatic EAB credential fetching for ZeroSSL — when
the directory URL is detected as ZeroSSL and no EAB credentials are
provided, certctl calls ZeroSSL's public API to get them automatically.

Changes:
- Wire EABKid/EABHmac into acme.Account.ExternalAccountBinding
- Add isZeroSSL() detection and fetchZeroSSLEAB() auto-fetch
- Add CERTCTL_ACME_EAB_KID/CERTCTL_ACME_EAB_HMAC env vars to main.go
- Add 13 ACME connector tests (config validation, EAB decode, ZeroSSL
  auto-EAB with mock servers, URL detection)
- Update docs: README, architecture, connectors, demo-advanced,
  testing-guide with EAB/auto-EAB documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
shankar0123
2026-03-27 15:34:48 -04:00
parent 87355c3efb
commit 03593d4304
8 changed files with 431 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/demo-advanced.md
+22
View File
@@ -11,6 +11,7 @@ This demo goes beyond browsing pre-loaded data. You'll create a team, register a
2. [How the pieces fit together](#how-the-pieces-fit-together)
3. [Alternative Issuers Reference](#alternative-issuers-reference)
- [Sub-CA Mode](#sub-ca-mode-local-ca-chained-to-enterprise-root)
- [ACME with ZeroSSL](#acme-with-zerossl-auto-eab)
- [ACME with DNS-01 Challenges](#acme-with-dns-01-challenges-wildcard-certificates)
- [ACME with DNS-PERSIST-01](#acme-with-dns-persist-01-zero-touch-renewals)
- [step-ca (Smallstep Private CA)](#step-ca-smallstep-private-ca)
@@ -96,6 +97,27 @@ docker compose -f deploy/docker-compose.yml restart server
The CA key can be RSA, ECDSA, or PKCS#8 format. The connector validates that the certificate has `IsCA=true` and `KeyUsageCertSign`.
### ACME with ZeroSSL (Auto-EAB)
ZeroSSL is a free ACME CA that requires External Account Binding (EAB) for account registration. certctl auto-fetches EAB credentials from ZeroSSL's public API when the directory URL is detected as ZeroSSL and no EAB credentials are provided — you just need an email address:
```bash
# Minimal config — certctl auto-fetches EAB credentials from ZeroSSL
export CERTCTL_ACME_DIRECTORY_URL="https://acme.zerossl.com/v2/DV90"
export CERTCTL_ACME_EMAIL="ops@example.com"
```
No dashboard visit, no manual EAB credential copy-paste. certctl calls `api.zerossl.com/acme/eab-credentials-email` with your email, gets back a KID + HMAC key, and uses them for ACME account registration automatically.
If you already have EAB credentials (e.g., from the ZeroSSL dashboard or for other CAs like Google Trust Services or SSL.com), you can provide them explicitly:
```bash
export CERTCTL_ACME_DIRECTORY_URL="https://acme.zerossl.com/v2/DV90"
export CERTCTL_ACME_EMAIL="ops@example.com"
export CERTCTL_ACME_EAB_KID="your-key-id"
export CERTCTL_ACME_EAB_HMAC="your-base64url-hmac-key"
```
### ACME with DNS-01 Challenges (Wildcard Certificates)
For Let's Encrypt or other ACME providers with wildcard support: