Hacker News new | ask | show | jobs
by Vecr 1109 days ago
I've looked at it more, it looks like this RCE could harvest the private key.
1 comments

I have no idea, my point was that in general the ACME client can't necessarily give you the private key even if it wanted to, because if you provide a CSR the key needn't even be on the same machine, let alone accessible in its execution environment.