I’ve been testing Certwarden for a couple of days and it has been working smoothly.
However, I ran into a strange issue with SSL.com’s ACME endpoints:
https://acme.ssl.com/sslcom-dv-ecc
https://acme.ssl.com/sslcom-dv-rsa
Both of these appear to require EAB keys for account registration. The odd part is that Certwarden is able to register without EAB — which shouldn’t be possible if the CA is advertising EAB as mandatory. Once the registration happens, SSL.com sends an email to the account address containing the EAB credentials, which suggests their ACME server isn’t actually enforcing or advertising the requirement correctly.
From what I can tell, Certwarden doesn’t currently provide a way to force EAB on registration unless the ACME directory explicitly demands it. This makes me think the issue lies on SSL.com’s side, since their ACME server isn’t signaling the EAB requirement in the directory metadata, but I assume it's so that people can easily generate EAB keys instead of going through their bullshit panel.
Any help would be appreciated on how to force EAB for registration
