Add --eab-hmac-alg parameter to support custom HMAC algorithm for EAB (#10319)

fixed: #10281

certbot/CHANGELOG.md

@@ -23,6 +23,12 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 More details about these changes can be found on our GitHub repo.
 
+## 4.2.0
+
+### Added
+
+* Added `--eab-hmac-alg` parameter to support custom HMAC algorithm for External Account Binding.
+
 ## 4.1.1 - 2025-06-12
 
 ### Fixed

certbot/src/certbot/_internal/cli/__init__.py

@@ -134,6 +134,13 @@ def prepare_and_parse_args(plugins: plugins_disco.PluginsRegistry, args: List[st
         metavar="EAB_HMAC_KEY",
         help="HMAC key for External Account Binding"
     )
+    helpful.add(
+        [None, "run", "certonly", "register"],
+        "--eab-hmac-alg", dest="eab_hmac_alg",
+        metavar="EAB_HMAC_ALG",
+        default=flag_default("eab_hmac_alg"),
+        help="HMAC algorithm for External Account Binding"
+    )
     helpful.add(
         [None, "run", "certonly", "manage", "delete", "certificates",
          "renew", "enhance", "reconfigure"], "--cert-name", dest="certname",

certbot/src/certbot/_internal/client.py

@@ -238,7 +238,8 @@ def perform_registration(acme: acme_client.ClientV2, config: configuration.Names
         eab = messages.ExternalAccountBinding.from_data(account_public_key=account_public_key,
                                                         kid=config.eab_kid,
                                                         hmac_key=config.eab_hmac_key,
-                                                        directory=acme.directory)
+                                                        directory=acme.directory,
+                                                        hmac_alg=config.eab_hmac_alg)
     else:
         eab = None
 

certbot/src/certbot/_internal/constants.py

@@ -82,6 +82,7 @@ CLI_DEFAULTS: Dict[str, Any] = dict(  # pylint: disable=use-dict-literal
     random_sleep_on_renew=True,
     eab_hmac_key=None,
     eab_kid=None,
+    eab_hmac_alg="HS256",
     issuance_timeout=90,
     run_deploy_hooks=False,