400 Bad Request: Could Not Create Thumbprint

Membrane API Gateway returns 400 Bad Request with the detail Could not create thumbprint! when the acmeHttpChallenge plugin receives a valid ACME HTTP-01 challenge request, but cannot compute the answer because the ACME account key is broken. Certificate issuance or renewal then fails.

The Error Response

The response contains the status 400 Bad Request, the detail Could not create thumbprint!, the problem type https://membrane-api.io/problems/user and a link to this page. Despite the type user and the status 400, the requester is not at fault. The certificate authority sent a correct challenge request; the problem is the account key stored on the gateway.

How the HTTP-01 Challenge Works

To prove control over a domain, the certificate authority, for example Let's Encrypt, requests a token under /.well-known/acme-challenge/ over plain HTTP. The acmeHttpChallenge plugin answers with the key authorization: the token combined with the thumbprint of the ACME account key. If the thumbprint cannot be computed, the plugin answers with this error. See Automatic Certificate Renewal with ACME for the setup.

Common Causes

The Account Key Is Not Valid JSON

The stored ACME account key, for example account.jwk.json in the fileStorage directory or the entry in kubernetesStorage, is corrupt or truncated.

The Account Key Has the Wrong Type

The stored key is valid JSON but not an elliptic-curve JWK, for example because the file was edited by hand or replaced with another key type.

How to Fix It

1. Check the account key in the storage configured on the acme element.
2. If it is corrupt, restore it from a backup.
3. Alternatively, remove it so that Membrane generates and registers a new account key. Note that this creates a new ACME account.
4. Check the log or enable development mode to see the underlying error message.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.

Related Documentation

Configuration reference:

• acmeHttpChallenge
• acme

← All Membrane error messages