Multiple AMCE Accounts with same URL

axelo

Hi Greg,

we are using DigiCert and their ACME requires setup with different API keys for different types of certificates, eg. wildcard, SAN, EV, etc. Certwarden will throw an error if we try to add a ne ACME account with the same URL as one already present in the system which prevents us from issuing certs of different flavor at the moment.

gregtwallace

Is Digicert also providing your DNS records or something?

From an ACME protocol standpoint, the DNS provisioning process is a black box. All the ACME Service should care about is that the TXT record exists when its told to validate the Challenge record.

axelo

Nono, this is only about acme accounts for cert issuance. They use the same URL at all times but for different types of certs you need to use a different API key. It's separate from validation. I'm open to having a call and showing you.

gregtwallace

What is the API key tied to / used for? ACME protocol doesn't use API keys, so I'm only familiar with using them in the context of provisioning dns records.

axelo

gregtwallace sorry, wrong terminology - each type of cert has it's own HMAC key and KID but the ACME endpoint is the same.

gregtwallace

Ah, I see, so two separate ACME Accounts.

I think it may not be technically possible to do what you're looking for. An order (for a certificate) is owned by one account under the acme spec and that order has the validation object under it as children. The account signs all of the payloads related to these things. It wouldn't be possible to sign with more than account (multiple signatures are not permitted in the spec). Therefore, I don't think it is possible to have one certificate related to more than one account/kid.

axelo

gregtwallace it's not about one certificate being under multiple KIDs but being able to issue certs of different types under different KIDs