Unable to validate JWS :: No Key ID in JWS header

[Bacteries]

Since 16th October I have issue with all my requests to Let's Encrypt (works fine before) :

SSL ordered failed for XXXX.fr : SSL creation call for domain XXXX.frr failed : Client error: POST https://acme-v02.api.letsencrypt.org/acme/new-order resulted in a 400 Bad Request response: { "type": "urn:ietf:params:acme:error:malformed", "detail": "Unable to validate JWS :: No Key ID in JWS header"

Any idea why this error occurs now ?

[Bacteries]

Hi, as I dig into this (not knowing much about ACME V2) this is what I done :

The error occurs when we get the account using jwk signature (and not kid). So we need to save the account_url needed everywhere by calling new account and saving the account_url for future use.

I done this using a method saveAccountURL() I call a single time then surcharging some methods that will trigger error if no account exist :

public function saveAccountURL()
    {
        $url = $this->getUrl(self::DIRECTORY_NEW_ACCOUNT);
        
        // Pour newAccount, on DOIT utiliser JWK (pas KID)
        $response = $this->request(
            $url,
            $this->signPayloadJWK(
                [
                    'onlyReturnExisting' => true,
                ],
                $url
            )
        );
        
        $accountURL = $response->getHeaderLine('Location');
        
        if ($accountURL) {
            $accountDataPath = $this->getPath('account_url.txt');
            $this->getFilesystem()->put($accountDataPath, $accountURL);
            echo "Account URL sauvegardée : " . $accountURL . PHP_EOL;
            return $accountURL;
        } else {
            throw new \Exception('Impossible de récupérer l\'account URL depuis le header Location');
        }
    }

protected function init()
    {
        //Load the directories from the LE api
        $response = $this->getHttpClient()->get('/directory');
        $result = Utils::jsonDecode((string)$response->getBody(), true);
        $this->directories = $result;

        //Prepare LE account
        $this->loadKeys();

        // Check if we have an account URL stored first
        $accountDataPath = $this->getPath('account_url.txt');
        if (!$this->getFilesystem()->has($accountDataPath)) {
            // Only agree to ToS if we don't have an account URL yet
            try {
                $this->tosAgree();
            } catch (\Exception $e) {
                // If tosAgree fails, the account might already exist
                // Try to get it with our custom logic
            }
        }

        // Use our custom getAccount method which handles KID/JWK logic
        try {
            $this->account = $this->getAccount();
        } catch (\Exception $e) {
            // If getAccount fails and we don't have account URL,
            // the account might need to be created first
            if (!$this->getFilesystem()->has($accountDataPath)) {
                throw new \Exception('Unable to initialize account. You may need to run saveAccountURL() first. Original error: ' . $e->getMessage());
            }
            throw $e;
        }
    }

protected function getKID($url): array
    {
        $response = $this->getHttpClient()->head($this->directories[self::DIRECTORY_NEW_NONCE]);
        $nonce = $response->getHeaderLine('replay-nonce');

        // Get account URL from stored account or from filesystem
        $accountURL = null;
        if ($this->account !== null) {
            $accountURL = $this->account->getAccountURL();
        } else {
            // Try to load account URL from filesystem
            $accountDataPath = $this->getPath('account_url.txt');
            if ($this->getFilesystem()->has($accountDataPath)) {
                $accountURL = $this->getFilesystem()->read($accountDataPath);
            }
        }

        if ($accountURL === null) {
            throw new \Exception('Account URL not available. Cannot use KID authentication.');
        }

        return [
            "alg"   => "RS256",
            "kid"   => $accountURL,
            "nonce" => $nonce,
            "url"   => $url
        ];
    }

    /**
     * Override tosAgree to store the account URL after creation
     */
    protected function tosAgree()
    {
        $response = $this->request(
            $this->getUrl(self::DIRECTORY_NEW_ACCOUNT),
            $this->signPayloadJWK(
                [
                    'contact'              => [
                        'mailto:' . $this->getOption('username'),
                    ],
                    'termsOfServiceAgreed' => true,
                ],
                $this->getUrl(self::DIRECTORY_NEW_ACCOUNT)
            )
        );

        // Store the account URL for future use
        $accountURL = $response->getHeaderLine('Location');
        if ($accountURL) {
            $accountDataPath = $this->getPath('account_url.txt');
            $this->getFilesystem()->put($accountDataPath, $accountURL);
        }
    }

    /**
     * Return LE account information
     * Fixed to use KID instead of JWK for existing accounts
     */
    public function getAccount(): Account
    {
        $url = $this->getUrl(self::DIRECTORY_NEW_ACCOUNT);

        // Check if we have an account URL stored (meaning account already exists)
        $accountDataPath = $this->getPath('account_url.txt');
        $useKid = $this->getFilesystem()->has($accountDataPath);

        if ($useKid) {
            // Account exists, use KID
            $response = $this->request(
                $url,
                $this->signPayloadJWK(
                    [
                        'onlyReturnExisting' => true,
                    ],
                    $url
                )
            );
        } else {
            // First time, use JWK
            $response = $this->request(
                $url,
                $this->signPayloadJWK(
                    [
                        'onlyReturnExisting' => true,
                    ],
                    $url
                )
            );

            // Store account URL for next time
            $accountURL = $response->getHeaderLine('Location');
            if ($accountURL) {
                $this->getFilesystem()->put($accountDataPath, $accountURL);
            }
        }

        $data = json_decode((string)$response->getBody(), true);
        $accountURL = $response->getHeaderLine('Location');
        $date = (new \DateTime())->setTimestamp(strtotime($data['createdAt']));
        return new Account($data['contact'] ?? [], $date, ($data['status'] == 'valid'), $accountURL);
    }

After a single call to saveAccountUrl() : all works fine.
A bit messy but I needed a quick fix to renew my SSL, I will dig for a better solution now.