[External Account Binding] Invalid MAC on JWS request

[soniaayaadav]

I am running win-acme in my local Window - 10 , after providing EAB credential (encoded64) , it gives error. Logs -
C:\ProgramData\win-acme\acme.zerossl.comv2DV90\20230516_Certificate_Subscriber_Agreement_v_2_6_click.pdf
2024-04-29 11:19:21.572 +12:00 [DBG] Creating new ES256 signer
2024-04-29 11:19:21.615 +12:00 [DBG] [HTTP] Send HEAD to "https://acme.zerossl.com/v2/DV90/newNonce"
2024-04-29 11:19:22.819 +12:00 [VRB] [HTTP] Request completed with status "OK"
2024-04-29 11:19:22.820 +12:00 [VRB] [HTTP] Empty response
2024-04-29 11:19:22.862 +12:00 [DBG] [HTTP] Send POST to "https://acme.zerossl.com/v2/DV90/newAccount"
2024-04-29 11:19:22.862 +12:00 [VRB] [HTTP] Request content: {"protected":"","signature":""}
2024-04-29 11:19:24.170 +12:00 [WRN] [HTTP] Request completed with status "BadRequest"
2024-04-29 11:19:24.171 +12:00 [VRB] [HTTP] Response content: {"type":"urn:ietf:params:acme:error:malformed","status":400,"detail":"[External Account Binding] Invalid MAC on JWS request"}
2024-04-29 11:19:24.198 +12:00 [ERR] (AcmeProtocolException): [External Account Binding] Invalid MAC on JWS request
2024-04-29 11:19:24.198 +12:00 [DBG] Exception details: {"ProblemType":"Malformed","Response":{"Version":{"Major":1,"Minor":1,"Build":-1,"Revision":-1,"MajorRevision":-1,"MinorRevision":-1,"$type":"Version"},"Content":{"Headers":[{"Key":"Content-Length","Value":["125"],"$type":"KeyValuePair2"},{"Key":"Content-Type","Value":["application/problem+json"],"$type":"KeyValuePair2"}],"$type":"NoWriteNoSeekStreamContent"},"StatusCode":"BadRequest","ReasonPhrase":"Bad Request","Headers":[{"Key":"Cache-Control","Value":["no-store, no-cache, max-age=0"],"$type":"KeyValuePair2"},{"Key":"Connection","Value":["keep-alive"],"$type":"KeyValuePair2"},{"Key":"Date","Value":["Sun, 28 Apr 2024 23:19:24 GMT"],"$type":"KeyValuePair2"},{"Key":"Server","Value":["nginx"],"$type":"KeyValuePair2"},{"Key":"Replay-Nonce","Value":["VchxVP2je1bbtqKvb7hXu7XQl4ycaeIUht6KLueSGkY"],"$type":"KeyValuePair2"},{"Key":"Access-Control-Allow-Origin","Value":["*"],"$type":"KeyValuePair2"},{"Key":"Link","Value":["https://acme.zerossl.com/v2/DV90;rel="index""],"$type":"KeyValuePair2"},{"Key":"Strict-Transport-Security","Value":["max-age=15724800; includeSubDomains"],"$type":"KeyValuePair2"}],"TrailingHeaders":[],"RequestMessage":{"Version":{"Major":1,"Minor":1,"Build":-1,"Revision":-1,"MajorRevision":-1,"MinorRevision":-1,"$type":"Version"},"VersionPolicy":"RequestVersionOrLower","Content":{"Headers":[{"Key":"Content-Type","Value":["application/jose+json"],"$type":"KeyValuePair2"},{"Key":"Content-Length","Value":["1075"],"$type":"KeyValuePair2"}],"$type":"StringContent"},"Method":{"Method":"POST","$type":"HttpMethod"},"RequestUri":"https://acme.zerossl.com/v2/DV90/newAccount","Headers":[{"Key":"User-Agent","Value":["win-acme/2.2.8.1635","(+https://github.com/win-acme/win-acme)"],"$type":"KeyValuePair`2"}],"Properties":[],"Options":[],"$type":"HttpRequestMessage"},"IsSuccessStatusCode":false,"$type":"HttpResponseMessage"},"ProblemTypeRaw":"urn:ietf:params:acme:error:malformed","ProblemDetail":"[External Account Binding] Invalid MAC on JWS request","ProblemInstance":null,"ProblemStatus":400,"TargetSite":"Void MoveNext()","Message":"[External Account Binding] Invalid MAC on JWS request","Data":[],"InnerException":null,"HelpLink":null,"Source":"ACMESharp","HResult":-2146233088,"StackTrace":" at ACMESharp.Protocol.AcmeProtocolClient.SendAcmeAsync(String relativeUri, HttpMethod method, String message, HttpStatusCode[] expectedStatuses, String opName)\r\n at ACMESharp.Protocol.AcmeProtocolClient.SendAcmeAsync[TResponse,TRequest](String uri, JsonTypeInfo1 requestType, JsonTypeInfo1 responseType, HttpMethod method, TRequest message, HttpStatusCode[] expectedStatuses, Boolean includePublicKey, String opName)\r\n at ACMESharp.Protocol.AcmeProtocolClient.CreateAccountAsync(IEnumerable1 contacts, Boolean termsOfServiceAgreed, Nullable1 externalAccountBinding)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientExtensions.<>c__DisplayClass1_01.<<Retry>b__0>d.MoveNext()\r\n--- End of stack trace from previous location ---\r\n at PKISharp.WACS.Clients.Acme.AcmeClientExtensions.Backoff[T](AcmeProtocolClient client, Func1 executor, ILogService log, Int32 attempt)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientExtensions.Backoff[T](AcmeProtocolClient client, Func1 executor, ILogService log, Int32 attempt)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientExtensions.Retry[T](AcmeProtocolClient client, Func1 executor, ILogService log, Int32 attempt)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientExtensions.Retry[T](AcmeProtocolClient client, Func`1 executor, ILogService log, Int32 attempt)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientManager.CreateAccount(AcmeProtocolClient client, AccountSigner signer, String[] contacts, String eabAlg, String eabKid, String eabKey)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientManager.SetupAccount(AcmeProtocolClient client)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientManager.SetupAccount(AcmeProtocolClient client)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientManager.CreateAuthorizedClient(String name)\r\n at PKISharp.WACS.Clients.Acme.AcmeClientManager.GetClient(String name)\r\n at PKISharp.WACS.RenewalExecutor.HandleRenewal(Renewal renewal, RunLevel runLevel)\r\n at PKISharp.WACS.RenewalCreator.FirstRun(Renewal renewal, RunLevel runLevel)\r\n at PKISharp.WACS.RenewalCreator.SetupRenewal(RunLevel runLevel, Steps steps, Renewal tempRenewal)\r\n at PKISharp.WACS.Host.MainMenu.MainMenuEntry(RunLevel runLevel)\r\n at PKISharp.WACS.Host.Wacs.Start()","$type":"AcmeProtocolException"}
2024-04-29 11:19:24.236 +12:00 [VRB] Exiting with status code -1

[WouterTinus]

Did you base64encode the key yourself? Because I think most providers already provide the key in base64 format.