{"record":{"id":"1ee230da24017730","repo":"caddyserver/caddy","slug":"performing-eab-credentials-request-v","errorCode":null,"errorMessage":"performing EAB credentials request: %v","messagePattern":"performing EAB credentials request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/acmeissuer.go","lineNumber":387,"sourceCode":"\tif len(acct.Contact) == 0 {\n\t\t// we borrow the email from config or the default email, so ensure it's saved with the account\n\t\tacct.Contact = []string{\"mailto:\" + iss.Email}\n\t}\n\n\tendpoint := zerossl.BaseURL + \"/acme/eab-credentials-email\"\n\tform := url.Values{\"email\": []string{iss.Email}}\n\tbody := strings.NewReader(form.Encode())\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, body)\n\tif err != nil {\n\t\treturn nil, acct, fmt.Errorf(\"forming request: %v\", err)\n\t}\n\treq.Header.Set(\"Content-Type\", \"application/x-www-form-urlencoded\")\n\treq.Header.Set(\"User-Agent\", certmagic.UserAgent)\n\n\tresp, err := http.DefaultClient.Do(req) //nolint:gosec // no SSRF since URL is from trusted config\n\tif err != nil {\n\t\treturn nil, acct, fmt.Errorf(\"performing EAB credentials request: %v\", err)\n\t}\n\tdefer resp.Body.Close()\n\n\tvar result struct {\n\t\tSuccess bool `json:\"success\"`\n\t\tError   struct {\n\t\t\tCode int    `json:\"code\"`\n\t\t\tType string `json:\"type\"`\n\t\t} `json:\"error\"`\n\t\tEABKID     string `json:\"eab_kid\"`\n\t\tEABHMACKey string `json:\"eab_hmac_key\"`\n\t}\n\terr = json.NewDecoder(resp.Body).Decode(&result)\n\tif err != nil {\n\t\treturn nil, acct, fmt.Errorf(\"decoding API response: %v\", err)\n\t}\n\tif result.Error.Code != 0 {\n\t\t// do this check first because ZeroSSL's API returns 200 on errors","sourceCodeStart":369,"sourceCodeEnd":405,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/acmeissuer.go#L369-L405","documentation":"The HTTP POST to ZeroSSL's EAB credentials endpoint (https://app.zerossl.com/acme/eab-credentials-email) failed at the transport level. This is a network-level failure: DNS resolution, TCP connection, TLS handshake, timeout, or connection refused. Note it uses http.DefaultClient, so it does not honor the issuer's configured proxy or timeouts.","triggerScenarios":"Any of: no internet egress from the Caddy host, DNS failure resolving app.zerossl.com, a firewall blocking outbound HTTPS, ZeroSSL being unreachable, or the process context being cancelled mid-request.","commonSituations":"Servers in isolated networks attempting ZeroSSL issuance; transient ZeroSSL outages; strict outbound firewall rules that only allow the ACME directory host but not the API host; IPv6-only hosts with broken routing.","solutions":["Verify outbound connectivity: curl -fsSL https://app.zerossl.com/ from the Caddy host.","Check DNS and firewall rules for app.zerossl.com on port 443, then retry issuance (systemctl reload caddy or a config change triggers a retry).","If egress is permanently restricted, obtain EAB credentials out-of-band from the ZeroSSL dashboard and configure external_account eab_kid/eab_hmac_key instead of relying on automatic generation.","If the problem persists, check ZeroSSL status pages or switch the issuer to Let's Encrypt."],"exampleFix":"// before: relying on automatic EAB generation behind a restricted firewall\n{\"issuer\": {\"ca\": \"https://zerossl.com/acme/eab\"}}\n\n// after: out-of-band EAB credentials\n{\n  \"issuer\": {\n    \"ca\": \"https://zerossl.com/acme/eab\",\n    \"external_account\": {\n      \"key_id\": \"<from ZeroSSL dashboard>\",\n      \"mac_key\": \"<from ZeroSSL dashboard>\"\n    }\n  }\n}","handlingStrategy":"retry","validationCode":"// Pre-flight connectivity to the EAB endpoint before enabling ZeroSSL.\nclient := &http.Client{Timeout: 10 * time.Second}\nresp, err := client.Head(\"https://app.zerossl.com/\")\nif err != nil {\n    return fmt.Errorf(\"no egress to ZeroSSL API: %v; configure manual EAB credentials\", err)\n}","typeGuard":null,"tryCatchPattern":"var lastErr error\nfor attempt := 0; attempt < 3; attempt++ {\n    lastErr = registerZeroSSL(ctx)\n    if lastErr == nil || !strings.Contains(lastErr.Error(), \"performing EAB credentials request\") {\n        break\n    }\n    time.Sleep(time.Duration(attempt+1) * 5 * time.Second)\n}","preventionTips":["Allow outbound 443 to app.zerossl.com in firewall rules alongside the ACME directory host.","Monitor issuance; alert on repeated EAB network failures.","Keep manual EAB credentials on hand for restricted-network deployments."],"tags":["tls","acme","zerossl","network","firewall"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}