Smallstep internal CA set up but no joy from win acme

[CvW]

Good morning.
I have successfully set up the small step CA on a pi, added the root trust certificates manually to the windows certificates manager, and entering https://tinyca.internal/acme/acme/directory returns the following with the trusted symbol in MS edge:

{"newNonce":"https://tinyca.internal/acme/acme/new-nonce","newAccount":"https://tinyca.internal/acme/acme/new-account","newOrder":"https://tinyca.internal/acme/acme/new-order","revokeCert":"https://tinyca.internal/acme/acme/revoke-cert","keyChange":"https://tinyca.internal/acme/acme/key-change"}

So far, everything suggests that I should be able to be able to use win acme to supply my windows machine with a certificate. Since I continue to fail at this, I decided to run WACS in admin + verbose mode to hopefully resolve this issue. Here are my steps and the results.

`C:\Program Files\Win ACME>wacs.exe --verbose
[VERB] Verbose mode logging enabled
[VERB] ExePath: C:\Program Files\Win ACME\wacs.exe
[VERB] ResourcePath: C:\Program Files\Win ACME
[VERB] PluginPath: C:\Program Files\Win ACME
[VERB] Looking for settings.json in C:\Program Files\Win ACME
[DBUG] Config folder: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org
[DBUG] Log path: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Log
[DBUG] Cache path: C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Certificates
[DBUG] secrets.json not found
[VERB] Arguments: --verbose
[DBUG] Renewal period: 55 days
[VERB] Sending e-mails False

[INFO] A simple Windows ACMEv2 client (WACS)
[INFO] Software version 2.1.17.1065 (release, pluggable, standalone, 64-bit)
[INFO] Connecting to https://acme-v02.api.letsencrypt.org/...
[VERB] SecurityProtocol setting: SystemDefault
[DBUG] Send GET request to https://acme-v02.api.letsencrypt.org/directory
[VERB] Request completed with status OK
[DBUG] Connection OK!
[DBUG] IIS not detected
[DBUG] Running with administrator credentials
[WARN] Scheduled task not configured yet
[INFO] Please report issues at https://github.com/win-acme/win-acme
[VERB] Unicode display test: Chinese/語言 Russian/язык Arab/لغة

N: Create certificate (default settings)
M: Create certificate (full options)
R: Run renewals (0 currently due)
A: Manage renewals (0 total)
O: More options...
Q: Quit

Please choose from the menu: M

[INFO] Running in mode: Interactive, Advanced
[VERB] Adding 8.8.8.8 as DNS server
[VERB] Adding 1.1.1.1 as DNS server
[VERB] Adding 8.8.4.4 as DNS server
[WARN] Target plugin IIS not available: No supported version of IIS detected.

Please specify how the list of domain names that will be included in the
certificate should be determined. If you choose for one of the "all bindings"
options, the list will automatically be updated for future renewals to
reflect the bindings at that time.

1: Read site bindings from IIS
2: Manual input
3: CSR created by another program
C: Abort

How shall we determine the domain(s) to include in the certificate?: 2

Enter comma-separated list of host names, starting with the common name: nuc.internal
[INFO] Target generated using plugin Manual: nuc.internal
Suggested friendly name '[Manual] nuc.internal', press to accept or type an alternative:

The ACME server will need to verify that you are the owner of the domain
names that you are requesting the certificate for. This happens both during
initial setup and for every future renewal. There are two main methods of
doing so: answering specific http requests (http-01) or create specific dns
records (dns-01). For wildcard domains the latter is the only option. Various
additional plugins are available from https://github.com/win-acme/win-acme/.

1: [http-01] Save verification files on (network) path
2: [http-01] Serve verification files from memory
3: [http-01] Upload verification files via FTP(S)
4: [http-01] Upload verification files via SSH-FTP
5: [http-01] Upload verification files via WebDav
6: [dns-01] Create verification records manually (auto-renew not possible)
7: [dns-01] Create verification records with acme-dns (https://github.com/joohoi/acme-dns)
8: [dns-01] Create verification records with your own script
9: [tls-alpn-01] Answer TLS verification request from win-acme
C: Abort

How would you like prove ownership for the domain(s)?: 7

URL of the acme-dns server: https://tinyca.internal/acme/acme/directory
[DBUG] Using C:\ProgramData\win-acme\acme-dns\tinyca.internalacmeacmedirectory for acme-dns configuration
[INFO] Creating new acme-dns registration for domain nuc.internal
[DBUG] Send POST request to https://tinyca.internal/acme/acme/register
[VERB] Request completed with status NotFound
[EROR] Error creating acme-dns registration
Newtonsoft.Json.JsonSerializationException: Error converting value 404 to type 'PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse'. Path '', line 1, position 3.
---> System.ArgumentException: Could not cast or convert from System.Int64 to PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse.
at Newtonsoft.Json.Utilities.ConvertUtils.EnsureTypeAssignable(Object value, Type initialType, Type targetType)
at Newtonsoft.Json.Utilities.ConvertUtils.ConvertOrCast(Object initialValue, CultureInfo culture, Type targetType)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.EnsureType(JsonReader reader, Object value, CultureInfo culture, JsonContract contract, Type targetType)
--- End of inner exception stack trace ---
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.EnsureType(JsonReader reader, Object value, CultureInfo culture, JsonContract contract, Type targetType)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
at Newtonsoft.Json.JsonSerializer.Deserialize(JsonReader reader, Type objectType)
at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value)
at PKISharp.WACS.Clients.AcmeDnsClient.Register()
[EROR] Validation plugin acme-dns was unable to generate options`

The thing that jumps out at me is the POST request that doesn't seem to be able to reach the "register" on the tinyca. Is that behavior expected? What else could I be doing wrong?

[bfqrst]

Hey @CvW,

I have been successfully able to get certs with this combo BUT I remember one thing that bit me:

If you put in your custom ACME endpoint omit the word directory at the end, because win-acme appends that by default. Took me a while to notice this. I'm not sure that that's your error, but give it a try!

Cheers!

[CvW]

Thank you so much for helping. Unfortunately, that didn't do it either. I entered the URL two different ways, once with the last directory slash, once without. The results are the same, see below:

` URL of the acme-dns server: https://tinyca.internal/acme/acme

[DBUG] Using C:\ProgramData\win-acme\acme-dns\tinyca.internalacmeacme for acme-dns configuration
[INFO] Creating new acme-dns registration for domain nuc.internal
[DBUG] Send POST request to https://tinyca.internal/acme/register
[VERB] Request completed with status NotFound
[EROR] Error creating acme-dns registration
Newtonsoft.Json.JsonSerializationException: Error converting value 404 to type 'PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse'. Path '', line 1, position 3.
---> System.ArgumentException: Could not cast or convert from System.Int64 to PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse.`

Or, with the second slash (which seems appropriate)

` URL of the acme-dns server: https://tinyca.internal/acme/acme/

[DBUG] Using C:\ProgramData\win-acme\acme-dns\tinyca.internalacmeacme for acme-dns configuration
[INFO] Creating new acme-dns registration for domain nuc.internal
[DBUG] Send POST request to https://tinyca.internal/acme/acme/register
[VERB] Request completed with status NotFound
[EROR] Error creating acme-dns registration
Newtonsoft.Json.JsonSerializationException: Error converting value 404 to type 'PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse'. Path '', line 1, position 3.
---> System.ArgumentException: Could not cast or convert from System.Int64 to PKISharp.WACS.Clients.AcmeDnsClient+RegisterResponse.` Etc.

It's a bit discouraging.

[tashian]

Great! I'm glad you got this resolved. We can't accept donations but we'll gladly accept any promotion of step-ca that you can offer, even if it's just a tweet (we're @smallsteplabs on twitter).

Finally, I've created smallstep/docs#87 to add win-acme to our documentation.

[CvW]

I don't have a twitter account, sorry. I'll try to promote you however over at the TrueNAS user forums, where I am pretty active.

[WouterTinus]

Happy to help!

[whoang44]

Awesome thread. Without the help of you guys, we would not be able to make this thing work. This tread should be posted on small step Q&A. They don't have much info for Windows clients

[tashian]

@whoang44 glad it worked for you! I've added it to our list of community-contributed tutorials and workflows