This article explains an issue where the ACME certificate enrolment fails on SRX.

You will see a parse failure error in PKI traces during the authorisation process:

Oct  7 23:50:26 acme-handle-response: AUTHORIZE_DOMAIN
Oct  7 23:50:26 acme-context-search: context search successful
Oct  7 23:50:26 Enrollment for certificate secure_connect_crt failed due to server reponse parsing failure

This issue occurs when either:

• The domain name does not publicly resolve to the SRX interface IP, or
• HTTP service is not enabled on the SRX interface.

During the initial enrollment, the Let’s Encrypt server attempts to connect to port 80 on the SRX interface. If HTTP service is disabled, the connection fails, resulting in a parse error.

Step 1: Enable HTTP Service on the Interface

Run the following commands to allow HTTP traffic on the untrust zone interface:

User@SRX> configure
User@SRX# set security zones security-zone untrust interface ge-0/0/0.0 host-inbound-traffic system-services http
User@SRX# commit

Step 2: Clear Existing Certificates and Keys

To restart the enrollment process from scratch, clear the existing certificates and keys using:

User@SRX> clear security pki local-certificate certificate-id <XYZ>
User@SRX> clear security pki ca-certificate ca-profile <XYZ>
User@SRX> clear security pki key-pair certificate-id <XYZ>

Replace with the actual certificate ID or CA profile name.