ACME External Account Binding support

ACME External Account Binding (EAB) is supported as defined in RFC 8555 section 7.3.4.

EAB is a way to associate an ACME account with an existing non-ACME account, such as a CA customer database, by adding additional information in newAccount requests. This additional information is used by the CA operating the ACME server to verify domain ownership by the requester, without the need for human users to follow interactive, natural-language instructions from the CA. Domain ownership verification is done when you register for EAB with your CA.

config vpn certificate local
    edit < name>
        set acme-eab-key-id <key>
        set acme-eab-key-hmac <HMAC>
    next
end

Command	Description
acme-eab-key-id <key>	External Account Binding Key ID (optional setting).
acme-eab-key-hmac <HMAC>	External Account Binding HMAC Key (URL-encoded base64).

A user obtains EAB from ACME CA or creates it using their web account access provided by ACME CA. Note that this feature is not supported by all CAs; for example, Let's Encrypt CA does not currently support EAB. Once created, EAB can be utilized for ACME certificate enrollment. Some ACME CAs allow the use of EAB as an authentication method, bypassing the standard online verification of domain ownership during the ACME certificate enrollment process via HTTP.

Example

In this example, public ZeroSSL CA is used (zerossl.com) as it supports EAB and allows registered accounts to create an EAB online. The server is an Azure VM with a public IP address and DNS.

To configure and verify ACME EAB:

1. Create an account with zeroSSL and create the EAB.

   Securely save both the eab-key-id and acme-eab-key-hmac. They are not stored in your account.

2. On the FortiGate, set the ACME interface to the port that is used for external communication:

   config system acme
       set interface port1
   end

3. Create a local VPN certificate using ACME as the enrollment protocol:

   config vpn certificate local
       edit "test-acme-zeroSSL"
           set enroll-protocol acme2
           set acme-ca-url "https://acme.zerossl.com/v2/DV90"  
           set acme-email owahn@fortinet.com
           set acme-eab-key-id "ZSx3bMEaa99RRt7wIjaRrw"
           set acme-eab-key-hmac "DeGr0jpQkZ1hqMVskqpe99dsyyPUM-SS77qqQQTTMM88-yy331kf2DOzmG6dg96aM3-HuHi_OVELPsBFQSLNJw"
           set acme-domain qa-fgt-acme-test-vkonddcbssww2.westus.cloudapp.azure.com
       next
   By enabling this feature you declare that you agree to the Terms of Service at https://acme.zerossl.com/v2/DV90
   Do you want to continue? (y/n)y
   end

4. Verify the results:

   config vpn certificate local
       edit "test-acme-zeroSSL"
           get
   name                : test-acme-zeroSSL
   password            : *
   comments            : Renewed with ACME on Tue Mar  4 22:43:35 2025 (UTC)
   private-key         : *
   certificate         :
           Subject:     CN = qa-fgt-acme-test-vkonddcbssww2.westus.cloudapp.azure.com
           Issuer:      C = AT, O = ZeroSSL, CN = ZeroSSL RSA Domain Secure Site CA
           Valid from:  2025-03-04 00:00:00  GMT
           Valid to:    2025-06-02 23:59:59  GMT
           Fingerprint: 3F:9A:A8:1F:3A:C4:AB:44:15:66:FD:83:EA:D0:58:01:4E:73:0B:52:69:22:9F:A0:1D:0A:17:FE:6A:7E:33:42
           Root CA:     No
           Version:     3
           Serial Num:
                   e8:90:0e:9f:0b:b7:76:3b:76:42:1b:1a:7a:81:02:e6
           Extensions:
                   Name:     X509v3 Authority Key Identifier
                   Critical: no
                   Content:
                   C8:D9:78:68:A2:D9:19:68:D5:3D:72:DE:5F:0A:3E:DC:B5:86:86:A6
   
                   Name:     X509v3 Subject Key Identifier
                   Critical: no
                   Content:
                   4C:B6:A3:DD:20:A4:33:2C:21:8A:B8:BA:96:A3:4E:FD:A3:2B:E3:BA
   
                   Name:     X509v3 Key Usage
                   Critical: yes
                   Content:
                   Digital Signature, Key Encipherment
   
                   Name:     X509v3 Basic Constraints
                   Critical: yes
                   Content:
                   CA:FALSE
   
                   Name:     X509v3 Extended Key Usage
                   Critical: no
                   Content:
                   TLS Web Server Authentication, TLS Web Client Authentication
   
                   Name:     X509v3 Certificate Policies
                   Critical: no
                   Content:
                   Policy: 1.3.6.1.4.1.6449.1.2.2.78
                   CPS: https://sectigo.com/CPS
                   Policy: 2.23.140.1.2.1
   
                   Name:     Authority Information Access
                   Critical: no
                   Content:
                   CA Issuers - URI:http://zerossl.crt.sectigo.com/ZeroSSLRSADomainSecureSiteCA.crt
                   OCSP - URI:http://zerossl.ocsp.sectigo.com
   
                   Name:     CT Precertificate SCTs
                   Critical: no
                   Content:
                   Signed Certificate Timestamp:
       Version   : v1 (0x0)
       Log ID    : CF:11:56:EE:D5:2E:7C:AF:F3:87:5B:D9:69:2E:9B:E9:
                   1A:71:67:4A:B0:17:EC:AC:01:D2:5B:77:CE:CC:3B:08
       Timestamp : Mar  4 22:43:32.069 2025 GMT
       Extensions: none
       Signature : ecdsa-with-SHA256
                   30:45:02:20:42:95:F3:A6:8D:23:8D:B7:FC:AC:69:E5:
                   82:78:D7:AA:B6:15:A1:3B:2F:C2:57:66:36:E8:96:63:
                   C4:16:F2:09:02:21:00:E3:59:20:04:3A:34:8B:0F:25:
                   04:A3:3B:52:AA:F
   
                   Name:     X509v3 Subject Alternative Name
                   Critical: no
                   Content:
                   DNS:qa-fgt-acme-test-vkonddcbssww2.westus.cloudapp.azure.com
   
   state               : OK
   range               : global
   source              : user
   source-ip           : 0.0.0.0
   ike-localid-type    : asn1dn
   enroll-protocol     : acme2
   acme-ca-url         : https://acme.zerossl.com/v2/DV90
   acme-domain         : qa-fgt-acme-test-vkonddcbssww2.westus.cloudapp.azure.com
   acme-email          : owahn@fortinet.com
   acme-eab-key-id     : ZSxXXXXXXXXXXXXXXXXXXXIjaRrw                                                                     
   acme-eab-key-hmac   : DeGr0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXBFQSLNJw   
   acme-rsa-key-size   : 2048
   acme-renew-window   : 30

   If the certificate details are not shown, check the detailed status and error messages for the enrollment process:

   #  diagnose sys acme status-full <acme-domain>