Skip to content
This repository was archived by the owner on Jun 9, 2026. It is now read-only.
This repository was archived by the owner on Jun 9, 2026. It is now read-only.

Renewals always have replaces= set? #406

Closed
Closed
Renewals always have replaces= set?#406
Assignees
icing

Description

@uschwarz
uschwarz
opened on Feb 11, 2026

Even with MDRenewViaARI off and "ari-renewals": false in the corresponding md.json, orders have the replaces attribute set.

This is unfortunate, RFC9773 says "Clients SHOULD NOT include this field if the ACME server has not indicated that it supports this protocol by advertising the renewalInfo resource in its Directory." and we do indeed use a CA that rejects these requests since they do not offer ARI.

Only "workaround" I have found so far is to either manually remove all traces of the currently-used certificate (i.e. in domains/ and archive/) or rotate the ServerName.
I guess ad_setup_order() might be a good place to check for that? (I'm sorry, I'm not fluent enough in httpd conventions to see what is easily visible where.)

[md:trace2] [pid 25343:tid 25346] md_acme.c(713): response: {\n  "newNonce": "https://acme-v02.harica.gr/acme/…/new-nonce",\n  "newAccount": "https://acme-v02.harica.gr/acme/…/new-acct",\n  "newOrder": "https://acme-v02.harica.gr/acme/…/new-order",\n  "revokeCert": "https://acme-v02.harica.gr/acme/…/revoke-cert",\n  "meta": {\n    "termsOfService": "https://repo.harica.gr/documents/SA-ToU.pdf",\n    "website": "https://www.harica.gr/",\n    "caaIdentities": [\n      "harica.gr"\n    ],\n    "externalAccountRequired": true\n  }\n}
[…]
[md:trace1] [pid 25343:tid 25346] md_acme.c(244): acme payload(len=748): {"identifiers":[{"type":"dns","value":"…"}],"replaces":"6Z…DA"}
[md:warn] [pid 25343:tid 25346] (22)Invalid argument: acme problem urn:ietf:params:acme:error:malformed: ARI Feature not enabled

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions