ACME error from OpnSense : "Le_OrderFinalize not found."

[lic0san]

I'm getting an error trying to issue a certificate through the ACME provisioner from OpnSense 23.1.6 (using acme.sh 3.0.5).
The Step CA server runs as a service on Debian 12 using step-ca 0.24.1 and step-cli 0.24.3.

OpnSense logs :

2023-04-26T19:08:20 | acme.sh | [Wed Apr 26 19:08:20 CEST 2023] Create new order error. Le_OrderFinalize not found. {}
2023-04-26T19:08:18 | acme.sh | [Wed Apr 26 19:08:18 CEST 2023] Getting domain auth token for each domain
2023-04-26T19:08:18 | acme.sh | [Wed Apr 26 19:08:18 CEST 2023] Single domain='opnsense.lab.home.arpa'
2023-04-26T19:08:18 | acme.sh | [Wed Apr 26 19:08:18 CEST 2023] The domain key is here: /var/etc/acme-client/home/opnsense.lab.home.arpa/opnsense.lab.home.arpa.key
2023-04-26T19:08:10 | acme.sh | [Wed Apr 26 19:08:10 CEST 2023] Creating domain key
2023-04-26T19:08:10 | acme.sh | [Wed Apr 26 19:08:10 CEST 2023] Using CA: https://ca.lab.home.arpa/acme/acme/directory

Step CA server logs :

Apr 26 19:08:10 ca step-ca[710]: time="2023-04-26T19:08:10+02:00" level=info duration="45.518µs" duration-ns=45518 fields.time="2023-04-26T19:08:10+02:00" method=GET name=ca path=/acme/acme/directory protocol=HTTP/2.0 referer= remote-address=10.10.10.254 request-id=ch4lkuj4prtc2ijtmdcg response="{"newNonce":"https://ca.lab.home.arpa/acme/acme/new-nonce\",\"newAccount\":\"https://ca.lab.home.arpa/acme/acme/new-account\",\"newOrder\":\"https://ca.lab.home.arpa/acme/acme/new-order\",\"revokeCert\":\"https://ca.lab.home.arpa/acme/acme/revoke-cert\",\"keyChange\":\"https://ca.lab.home.arpa/acme/acme/key-change\"}" size=302 status=200 user-agent="acme.sh/3.0.5 (https://github.com/acmesh-official/acme.sh)" user-id=
Apr 26 19:08:19 ca step-ca[710]: time="2023-04-26T19:08:19+02:00" level=info duration=8.716823ms duration-ns=8716823 fields.time="2023-04-26T19:08:19+02:00" method=HEAD name=ca nonce=bzlSQzZxWGJJWHA4UGZBcndTcjk3Q3g2cnF4d3ZMTTc path=/acme/acme/new-nonce protocol=HTTP/2.0 referer= remote-address=10.10.10.254 request-id=ch4ll0r4prtc2ijtmdd0 size=0 status=200 user-agent="acme.sh/3.0.5 (https://github.com/acmesh-official/acme.sh)" user-id=
Apr 26 19:08:20 ca step-ca[710]: time="2023-04-26T19:08:20+02:00" level=error duration=13.150759ms duration-ns=13150759 error="not found" fields.time="2023-04-26T19:08:20+02:00" method=POST name=ca nonce=WXlxQkxnaFlCU010aWdQUHlwOEdZWXhFT0I2WFdXRk0 path=/acme/acme/new-order protocol=HTTP/2.0 referer= remote-address=10.10.10.254 request-id=ch4ll134prtc2ijtmddg size=3 status=500 user-agent="acme.sh/3.0.5 (https://github.com/acmesh-official/acme.sh)" user-id=

Any pointers ?

[hslatman]

I don't see a request for a new account in the CA logs. Did you omit part of the logs? Did you have a working setup before, or are you setting it up?

One of the things the CA may not be able to find when a new order is created, is the ACME account. This can happen if there's a mismatch between the CA and ACME client state. You can take a look in the ~/.acme.sh directory to see if there's some information about the ACME account the client uses. It may also be possible to reset the client state by removing some or all files.

[lic0san]

Thank you for your precise insight ! Indeed, it was a previously working setup (with an older Step CA server installation). I removed and recreated the client ACME account on OpnSense side, and the certificate is now issued as expected by the new server. Sorry I miss-posted this in the issues tracker !