Support EAB without challengetype #648

Open
opened 2025-12-29 01:28:10 +01:00 by adam · 2 comments
Owner

Originally created by @gvde on GitHub (Sep 9, 2025).

Sectigo and Harica (and possibly others) support acme with eab without requiring a challengetype. The names allowed for the request are configured for the acme account.

Currently, we have to set a fake CHALLENGETYPE and comment out the first line of verify_config to use dehydrated.

Originally created by @gvde on GitHub (Sep 9, 2025). Sectigo and Harica (and possibly others) support acme with eab without requiring a challengetype. The names allowed for the request are configured for the acme account. Currently, we have to set a fake CHALLENGETYPE and comment out the first line of verify_config to use dehydrated.
Author
Owner

@sbdlt commented on GitHub (Dec 2, 2025):

Same situation here.

No need to comment a line in verify_config, you can just use an existing challenge type and add a comment in the config file to remember that this has no use. No challenge will be made if the ACME endpoint does not need it.

@sbdlt commented on GitHub (Dec 2, 2025): Same situation here. No need to comment a line in verify_config, you can just use an existing challenge type and add a comment in the config file to remember that this has no use. No challenge will be made if the ACME endpoint does not need it.
Author
Owner

@gvde commented on GitHub (Dec 2, 2025):

Same situation here.

No need to comment a line in verify_config, you can just use an existing challenge type and add a comment in the config file to remember that this has no use. No challenge will be made if the ACME endpoint does not need it.

Not quite. If you set "http-01" you have to define a WELLKNOWN, if you use "dns-01" you have to define a HOOK. Only for "tls-alpn-01" it would not require anything else. Either way, it's not nice nor intuitive.

@gvde commented on GitHub (Dec 2, 2025): > Same situation here. > > No need to comment a line in verify_config, you can just use an existing challenge type and add a comment in the config file to remember that this has no use. No challenge will be made if the ACME endpoint does not need it. Not quite. If you set "http-01" you have to define a `WELLKNOWN`, if you use "dns-01" you have to define a `HOOK`. Only for "tls-alpn-01" it would not require anything else. Either way, it's not nice nor intuitive.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/dehydrated#648