🔱: [acme] sync upgrade with 7 commits [trident-sync]

Add Node v22 to test matrix
Postpone Pebble bump, v2.5.1 broke EAB tests
Bump Pebble v2.5.1
Allow client.auto() being called with an empty CSR common name
Carry EAB over to new HttpClient when updating account key
Ignore actrc

packages/core/acme-client/.github/scripts/tests-install-pebble.sh

@@ -28,6 +28,6 @@ chown root:root /usr/local/bin/pebble
 chmod 0755 /usr/local/bin/pebble
 
 # Config
-sed -i 's/test\/certs\/localhost/\/etc\/pebble/' /etc/pebble/pebble.json
+sed -i 's#test/certs/localhost#/etc/pebble#' /etc/pebble/pebble.json
 
 exit 0

packages/core/acme-client/.github/workflows/tests.yml

@@ -9,7 +9,7 @@ jobs:
 
     strategy:
       matrix:
-        node: [16, 18, 20]
+        node: [16, 18, 20, 22]
         eab: [0, 1]
 
 

packages/core/acme-client/.gitignore

@@ -1,3 +1,4 @@
+.actrc
 .vscode/
 node_modules/
 npm-debug.log

packages/core/acme-client/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v5.3.1
+
+* `fixed` Allow `client.auto()` being called with an empty CSR common name
+* `fixed` Bug when calling `updateAccountKey()` with external account binding
+
 ## v5.3.0 (2024-02-05)
 
 * `added` Support and tests for satisfying `tls-alpn-01` challenges

packages/core/acme-client/src/auto.js

@@ -59,9 +59,8 @@ module.exports = async function(client, userOpts) {
      */
 
     log('[auto] Parsing domains from Certificate Signing Request');
-    const csrDomains = readCsrDomains(opts.csr);
-    const domains = [csrDomains.commonName].concat(csrDomains.altNames);
-    const uniqueDomains = Array.from(new Set(domains));
+    const { commonName, altNames } = readCsrDomains(opts.csr);
+    const uniqueDomains = Array.from(new Set([commonName].concat(altNames).filter((d) => d)));
 
     log(`[auto] Resolved ${uniqueDomains.length} unique domains from parsing the Certificate Signing Request`);
 

packages/core/acme-client/src/client.js

@@ -261,7 +261,7 @@ class AcmeClient {
         const accountUrl = this.api.getAccountUrl();
 
         /* Create new HTTP and API clients using new key */
-        const newHttpClient = new HttpClient(this.opts.directoryUrl, newAccountKey);
+        const newHttpClient = new HttpClient(this.opts.directoryUrl, newAccountKey, this.opts.externalAccountBinding);
         const newApiClient = new AcmeApi(newHttpClient, accountUrl);
 
         /* Get old JWK */

packages/core/acme-client/test/70-auto.spec.js

@@ -299,7 +299,6 @@ describe('client.auto', () => {
 
             it('should order san certificate', async () => {
                 const [, csr] = await acme.crypto.createCsr({
-                    commonName: testSanDomains[0],
                     altNames: testSanDomains
                 }, await createKeyFn());