Sebastian Krause the source of a strange incompatibility with the service script , used for automating the acquisition of TLS certificates via the ACME protocol. Both the Bypass and the reference client, as well as uacme, work, but dehydrated does not (more accurately, it did work with some workarounds, but only in dns-1 mode).
The reason turned out to be banal: instead of properly parsing the JSON response, the author of dehydrated used a feature of the specific JSON output formatting from the Let’s Encrypt service and performed parsing using a regular expression. However, Bypass returns not nicely formatted but minified JSON, and the used did not work. This approach does not rule out problems with LetsEncrypt if this service unexpectedly changes the output format in the future, while remaining fully within the official protocol.
During the discussion of the problem, it was suggested to use an external JSON parser, such as or (add in pipe ‘jq -r «.authorizations | .[]»‘ for correct parsing).
The downside of this approach is the dilution of the idea of managing with minimal and easily verifiable means, as well as error handling issues.
The author of the dehydrated project (the project was recently to Apilayer GmbH) , that JSON parsing is a major problem, but he does not consider adding external parsers a good idea, as one of the key advantages of the script is the absence of dependencies on external entities. He is currently busy but hopes to pay attention to solving the problem in the next few days. He plans to redesign the JSON parser or integrate a ready-made parser in shell language — .
Source: opennet.ru
