When a client registers an ACME account with an external account binding
key that has already been bound, step-ca answers 500 serverInternal
instead of 401 unauthorized.
ExternalAccountKey.BindTo clears the key's HMAC bytes when it binds
("can only be used once"), and validateExternalAccountBinding checked
for missing key bytes before checking whether the key was bound. So
every reuse of a bound key reached the server-error branch, and the
already-bound branch below it was unreachable for any key that had
been bound through BindTo. The existing test for that branch passes
only because its fixture keeps key bytes on a bound key, which BindTo
never produces.
The status matters because ACME clients treat 5xx as retryable. Go's
golang.org/x/crypto/acme client retried until its context deadline, a
full minute in my test; certbot and cert-manager back off and retry
the same way. A misconfigured client that reuses a key now gets a
definite 401 and stops.
The fix checks AlreadyBound before the key bytes. An unbound key with
no key bytes is still a server error, unchanged. The new test case
builds the key the way BindTo leaves it and fails against the old
order.
go build, go vet and gofmt are clean with CGO_ENABLED=0 (the cgo build
needs libpcsclite, which this machine lacks); ./acme/... passes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
3b58a2a81e