FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

What is EAB (External Account Binding) in ACME? ​

Short answer

EAB (External Account Binding) is the mechanism that binds an ACME account to an existing customer account at the CA (RFC 8555). Let's Encrypt does not require EAB because it is open to everyone; some CAs, however, generate a Key ID and an HMAC key in the account panel to verify that the request comes from their own customer before issuing a certificate with ACME. In TR7, the EAB ID / EAB HMAC fields in the ACME.SH certificate form appear only when zerossl, sslcom or google is selected as the Acme.sh Server; when the two fields are filled in together, they are used while the ACME account is being registered.

Where It Is Used in TR7 ​

WhereField / labelWhat for
Certificates & PKI → SSL/TLS Certificates → Add → ACME.SHEAB ID / EAB HMAC (Acme.sh server = zerossl, sslcom or google)Binding the ACME account to the customer account at the CA
ACME.SH form → information box under Acme.sh ServerThe link to the guide from which the EAB credentials are obtained for sslcom and google; the CA that must be present in the CAA record of the domainSeeing where the EAB ID is obtained from

How Does It Work? ​

  1. A Key ID and the HMAC key that belongs to it are generated in the customer panel of the CA.
  2. While opening a new account, the ACME client signs the account public key with this HMAC key and sends it together with the Key ID.
  3. The CA verifies the signature and binds the ACME account to that customer account; subsequent certificate requests are made through this account.

Common Misconceptions ​

  • "EAB is required on every ACME server." It is not used with Let's Encrypt; in TR7, the fields appear only while zerossl, sslcom or google is selected.
  • "One of the EAB fields is enough." The ID and the HMAC key are used together; TR7 adds EAB to the request if both fields are filled in.
  • "EAB means sending the HMAC key with every request." The HMAC key is not sent; it is used only to generate a signature during the account registration.

How it is done in the documentation

Related questions