acme
ACME Protocol Error Codes
Standard error types defined by RFC 8555 (Automatic Certificate Management Environment), returned in the "type" field of a problem document as urn:ietf:params:acme:error:<code>. Used by Let's Encrypt and other ACME-compatible certificate authorities via clients such as Certbot, acme.sh, and win-acme.
24 codes
references rfc-editor.org/rfc/rfc8555
· All codes 24 codes
- accountDoesNotExist Account Does Not Exist The request specified an account that does not exist. Returned when a JWS is signed with a key ID (kid) that does not correspond to a registered account on the ACME server.
- alreadyRevoked Already Revoked The request specified a certificate to be revoked that has already been revoked. Returned by the revokeCert endpoint when the target certificate's status is already 'revoked'.
- badCSR Bad CSR The Certificate Signing Request (CSR) submitted with a finalize request is unacceptable, for example because it uses a key that is too short or requests an identifier not authorized by the order.
- badNonce Bad Nonce The client sent an unacceptable anti-replay nonce in the Replay-Nonce header, because it was missing, malformed, or already used. The client should retry the request using a fresh nonce from the Replay-Nonce header of the error response.
- badPublicKey Bad Public Key The JWS included in the request was signed by a public key the server does not support, such as a key that is too weak or uses an unsupported algorithm.
- badRevocationReason Bad Revocation Reason The revocation reason code supplied in a certificate revocation request is not one of the reason codes allowed by the server (per RFC 5280 CRLReason).
- badSignatureAlgorithm Bad Signature Algorithm The JWS included in the request was signed with an algorithm the server does not support. The error response includes an 'algorithms' field listing the algorithms the server accepts.
- caa CAA Records Forbid Issuance Certification Authority Authorization (CAA) records published in DNS for the requested identifier forbid this CA from issuing a certificate for it.
- compound Compound Error The error represents multiple problems and the specific conditions are indicated in the 'subproblems' array of the problem document, each with its own type, detail, and optionally an 'identifier'.
- connection Connection Error The server could not connect to the validation target while performing an http-01 or tls-alpn-01 challenge, for example because the connection was refused or timed out.
- dns DNS Problem There was a problem with a DNS query during identifier validation, such as an NXDOMAIN response, a DNS lookup timeout, or a malformed DNS response while resolving a dns-01 challenge or the identifier itself.
- externalAccountRequired External Account Required The request must include a value for the 'externalAccountBinding' field, because the CA requires linking ACME accounts to an existing account in an external system.
- incorrectResponse Incorrect Response The response body received while validating a challenge did not match the requirements. Commonly seen with http-01 (unexpected content at the challenge URL) or dns-01 (missing or wrong TXT record value).
- invalidContact Invalid Contact A contact URL for an account, supplied in the 'contact' field, was invalid — for example a malformed URL or an email address that fails validation.
- malformed Malformed Request The request message was malformed, such as invalid JSON, a missing required field, or a payload that does not conform to the expected ACME message schema.
- orderNotReady Order Not Ready The request attempted to finalize an order that is not yet in the 'ready' state, typically because one or more of its authorizations have not been completed.
- rateLimited Rate Limited The request exceeds a rate limit enforced by the server, such as Let's Encrypt's limits on certificates per registered domain or failed validations per account per hostname.
- rejectedIdentifier Rejected Identifier The server will not issue certificates for the identifier, for example because it appears on a denylist or is otherwise disallowed by CA policy.
- serverInternal Internal Server Error The server experienced an internal error while processing the request. Returned with HTTP 500; the client should retry later, and persistent occurrences should be reported to the CA.
- tls TLS Error The server received a TLS error during validation, for example while attempting a tls-alpn-01 challenge, such as a handshake failure or an invalid certificate presented by the validation target.
- unauthorized Unauthorized The client lacks sufficient authorization, for example because an authorization has expired, a challenge was not completed for the identifier, or the account is not authorized to request a certificate for it.
- unsupportedContact Unsupported Contact A contact URL for an account used a protocol scheme the server does not support, such as anything other than the mailto: scheme.
- unsupportedIdentifier Unsupported Identifier An identifier included in a new-order request is of a type the server does not support (the ACME base spec only mandates support for the 'dns' identifier type).
- userActionRequired User Action Required The client must visit the URL given in the problem document's 'instance' field and take the action specified there before the request can proceed, such as agreeing to updated terms of service.