From 6f0d468be9190853b389cf307f5d12f32e8298c5 Mon Sep 17 00:00:00 2001
From: Fu Diwei <fudiwei@sina.com>
Date: Fri, 5 Sep 2025 18:12:41 +0800
Subject: [PATCH] fix: could not register acme external account

---
 internal/certapply/account.go | 20 +++++++++++++++++---
 internal/certapply/config.go  |  6 +++---
 internal/domain/expr/expr.go  |  2 +-
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/internal/certapply/account.go b/internal/certapply/account.go
index f609dfce0..34d53cea1 100644
--- a/internal/certapply/account.go
+++ b/internal/certapply/account.go
@@ -7,6 +7,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/go-acme/lego/v4/lego"
 	"github.com/go-acme/lego/v4/registration"
@@ -70,10 +71,23 @@ func NewACMEAccount(config *ACMEConfig, email string, register bool) (*ACMEAccou
 		var regres *registration.Resource
 		var regerr error
 		if legoClient.GetExternalAccountRequired() {
+			if config.EABKid == "" {
+				return nil, errors.New("missing or invalid eab kid")
+			}
+			if config.EABHmacKey == "" {
+				return nil, errors.New("missing or invalid eab hmac key")
+			}
+
+			// patch, see https://github.com/go-acme/lego/issues/2634
+			keyId := strings.TrimSpace(config.EABKid)
+			keyEncoded := strings.TrimSpace(config.EABHmacKey)
+			keyEncoded = strings.ReplaceAll(strings.ReplaceAll(keyEncoded, "+", "-"), "/", "_")
+			keyEncoded = strings.TrimRight(keyEncoded, "=")
+
 			regres, regerr = legoClient.Registration.RegisterWithExternalAccountBinding(registration.RegisterEABOptions{
 				TermsOfServiceAgreed: true,
-				Kid:                  config.EABKid,
-				HmacEncoded:          config.EABHmacEncoded,
+				Kid:                  keyId,
+				HmacEncoded:          keyEncoded,
 			})
 		} else {
 			regres, regerr = legoClient.Registration.Register(registration.RegisterOptions{
@@ -81,7 +95,7 @@ func NewACMEAccount(config *ACMEConfig, email string, register bool) (*ACMEAccou
 			})
 		}
 		if regerr != nil {
-			return nil, fmt.Errorf("failed to register acme account: %w", err)
+			return nil, fmt.Errorf("failed to register acme account: %w", regerr)
 		}
 
 		account.ACMEAccount = &regres.Body
diff --git a/internal/certapply/config.go b/internal/certapply/config.go
index a1eaeb731..8b36d778d 100644
--- a/internal/certapply/config.go
+++ b/internal/certapply/config.go
@@ -34,7 +34,7 @@ type ACMEConfig struct {
 	CAProvider       domain.CAProviderType
 	CADirUrl         string
 	EABKid           string
-	EABHmacEncoded   string
+	EABHmacKey       string
 	CertifierKeyType certcrypto.KeyType
 }
 
@@ -93,12 +93,12 @@ func NewACMEConfig(options *ACMEConfigOptions) (*ACMEConfig, error) {
 		ca.CADirUrl = endpoint
 	}
 
-	eab := &domain.AccessConfigForACMEExternalAccountBinding{}
+	eab := domain.AccessConfigForACMEExternalAccountBinding{}
 	if err := xmaps.Populate(caAccessConfig, &eab); err != nil {
 		return nil, err
 	}
 	ca.EABKid = eab.EabKid
-	ca.EABHmacEncoded = eab.EabHmacKey
+	ca.EABHmacKey = eab.EabHmacKey
 
 	return ca, nil
 }
diff --git a/internal/domain/expr/expr.go b/internal/domain/expr/expr.go
index 755a876cb..e42a39672 100644
--- a/internal/domain/expr/expr.go
+++ b/internal/domain/expr/expr.go
@@ -53,7 +53,7 @@ func (e *EvalResult) GetFloat64() (float64, error) {
 
 	floatValue, err := strconv.ParseFloat(stringValue, 64)
 	if err != nil {
-		return 0, fmt.Errorf("failed to parse float64: %v", err)
+		return 0, fmt.Errorf("failed to parse float64: %w", err)
 	}
 	return floatValue, nil
 }