From: "Anthony J. Bentley" <bentley@openbsd.org>
Subject: Re: acme-client: support for external account binding
To: Jonathan Matthew <jonathan@d14n.org>
Cc: tech@openbsd.org, sthen@openbsd.org, florian@openbsd.org
Date: Thu, 11 Jun 2026 04:26:06 -0600

Jonathan Matthew writes:
> Sadly this adds yet another base64 decoder implementation, because there
> wasn't one using the base64url encoding that acme-client could get to.
> This one is based on the libc bcrypt implementation, because it's short and
> uncomplicated and doesn't care about padding.

It seems that padding matters here. Actalis gave me a key ending in =
which acme-client doesn't understand:

$ acme-client -e XXXXXXXXXXXXXXXXXXXXXXXXXX:YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYABC= mydomain
acme-client: unable to decode EAB key