Description

Unable to enroll with LetsEncrypt/ACME protocol.

Symptoms

The documentation from the link ACME Protocol | Junos OS | Juniper Networks shows how to enroll a firewall using Let'sEncrypt certificates with the ACME protocol. However, on step 3 it states that we need to upload a certificate but it does not show how or where to get this cert. If we try to run the command "request security pki ca-certificate load ca-profile ISRG_Root_X1 filename ISRG_Root_X1.pem" we will receive the following error:

 

------------------------------------------------------------------------------------------------------------------------------------

error: Failed to read the certificate file /cf/var/home/<user>/ISRG_Root_X1.pem. The certificate might not exist or it might be corrupted.

 

If we run some PKI traceoptions, we will find some errors as well:

 

Jul 30 11:08:20 Cert-Chain-Val> PKI, verify cert, cannot locate CA certificate

Jul 30 11:08:20 acme-handle-https-packet: server certificate verification error: application verification failure

Jul 30 11:08:20 acme-handle-https-packet: ACME HTTPS Connect failed with error string error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed error 1

Jul 30 11:08:20 Enrollment for certificate ACME-CERT failed due to server certificate verification failure

 



Solution

In order to solve this problem, kindly follow the steps given below: 

  •  Go to LetsEncrypt official website (https://letsencrypt.org/certificates/)
  • Check the certificate information
  • Export/download the ISRG root certificate from the website to your local machine.
  • Move it to SRX to the path the previous error message was showing (/cf/var/home/<user>/)
  • Post that you can load the certificate to SRX using the command:

root@SRX>request security pki ca-certificate load ca-profile ISRG_Root_X1 filename ISRG_Root_X1.pem

 

To copy the certificate to SRX from local PC, you can follow the steps given in the KB below: 

How to copy files to SRX using USB

 

Below are the snips from the Let's Encrypt website: 

 

Modification History

2024-08-05 : Article Created

2025-06-11: Modified Solution 

Related Information

ACME Protocol