Using EAB tokens

EAB (External Account Binding) tokens allow an ACME client to securely self-provision a new Account key. They may be used only a single time.

EAB tokens may be created through both the UI and API.

Client compatibility

Many ACME clients support EAB tokens, although not all.

CertFu’s EAB tokens are compatible with:

• Format: MAC key as Base64
• HMAC type: HS256

EAB token settings

Settings here are the same as their Account key equivalents and will be copied to the Account key when the EAB token is consumed.

Name - A human-friendly name for the EAB token / Account key. Use it to describe the hostname and/or client software instance that this Account key will be used by.

Order validations -

• Use challenges - This is the standard security mode for an ACME client and is generally recommended. New certs will require validation before certs are issued. Validation of domain names requires publically available DNS and possibly public HTTP access on port 80. CAA DNS records will also be validated.
• Auto-approve - Bypass all challenges/validation checks for this client. This is required for private domains or IPs.
  Some ACME clients may get briefly confused and internally retry once to discover that the order was auto-approved. A few clients may also be unable to handle this entirely; in that case, file a bug report for the client or try another one.