security/acme-client: Provided agreement URL does not match current agreement URL

[rschueler]

When issuing a new certifcate the process fails with following log messages:

Update account error. code='400'
response='{"type":"urn:acme:error:malformed","detail":"Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]","status": 400}'
responseHeaders='HTTP/1.1 100 Continue "detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]",
original='{_ret='0'
_CURL='curl -L --silent --dump-header /var/etc/acme-client/home/http.header '

[dharrigan]

I believe this is fixed already in acme.sh 2.7.5

#418

acmesh-official/acme.sh#1112

-=david=-

[fichtner]

We could pull it in, it's in FreeBSD, but I need an ack from @fraenki as we have agreed a while ago.

[fichtner]

For reference, 2.7.5 could be installed on the OPNsense like this:

# opnsense-code tools ports
# cd /usr/ports/security/acme.sh
# git checkout acme_sh
# make
# make deinstall
# make install

[fraenki]

Thanks for reporting this issue! ❤️
I've greenlit acme.sh 2.7.5, it will be included in the next release :)

[fichtner]

There was a forum post that said the next version does not fix this (automatically). I don’t have the link at the moment.

…

On 12. Jan 2018, at 22:08, Frank Wall ***@***.***> wrote: Thanks for reporting this issue! ❤️ I've greenlit acme.sh 2.7.5, it will be included in the next release :) — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[fraenki]

It turned out that acme.sh 2.7.5 did not contain a fix, but instead acme.sh 2.7.6 will finally include a fix:
acmesh-official/acme.sh@f87890c

[fichtner]

Any idea when this will be released?

[fraenki]

Any idea when this will be released?

Nope. :( The number of changes in acme.sh 2.7.6 already scares me, so he should take his time to make it a stable release.

[fraenki]

acme.sh 2.7.6 is available in the current release of OPNsense.