What would cause the error "Error creating new cert :: Certificate public key must be different than account key"

[russellballestrini]

{"type":"urn:acme:error:malformed","detail":"Error creating new cert :: Certificate public key must be different than account key"}

I'm using the following process to create public and private keys and CSR:

http://www.foxhop.net/ssl-certificates#how-i-manage-requesting-certs

[diafygi]

Your user.key and domain.key can't be the same private key. Unfortunately, this is a restriction by Let's Encrypt[1].

[1] - https://github.com/letsencrypt/boulder/blob/master/ra/registration-authority.go#L483

[russellballestrini]

Thank you for the really quick reply!

Wow, ok thats a pain. I'm thinking about creating a PR that puts $USERKEY instead of user.key to stdout, so that the lines are documented but could also be copied and pasted without modification if the user has the environment var set.

Thoughts?

[diafygi]

Interesting, the issue I see is that if users export USERKEY="/path/to/user.key" in their current terminal (seems likely), then when you paste the commands into a new terminal window, that environmental variable won't be available.

[russellballestrini]

Yeah, it would need to be exported in the term that the pasting is occurring in, but still acts as a placeholder if they don't want to use ENV vars.

[diafygi]

how about this?

STEP 2: You need to sign some files (replace './user.key' with the path to your user private key).

export USERKEY="./user.key"
openssl dgst -sha256 -sign $USERKEY -out register_KN2ihH.sig register_ABUO4T.json
openssl dgst -sha256 -sign $USERKEY -out domain_BbpWG4.sig domain_rSKa5G.json
openssl dgst -sha256 -sign $USERKEY -out challenge_fo6_ib.sig challenge_e3gHzd.json
openssl dgst -sha256 -sign $USERKEY -out cert_36OUdW.sig cert_3IZULZ.json

Press Enter when you've run the above commands in a new terminal window...

[russellballestrini]

Looks good to me, STEP 3 output would need the same change.

Also now that I think about it, maybe $USER_PRIVATE_KEY is more descriptive / verbose.

I just successfully used this tool to create a cert, great work!

I'm going to be writing a blog post later tonight.

[diafygi]

Cool, do you want the honors of doing a pull request, or should I do it?

[russellballestrini]

I'll work on a PR after dinner. ; )

On Thu, Nov 5, 2015, 5:59 PM Daniel Roesler notifications@github.com
wrote:

Cool, do you want the honors of doing a pull request, or should I do it?

—
Reply to this email directly or view it on GitHub
#11 (comment)
.

[russellballestrini]

This was user error, I misunderstood which keys were needed.