From bea28f7623daa4439132a0a7e55ccea07da49ee6 Mon Sep 17 00:00:00 2001
From: Abhay <abhayjnayakpro@gmail.com>
Date: Sun, 19 Apr 2026 22:41:49 +0530
Subject: [PATCH] fix: enforce termsOfServiceAgreed when termsOfService is
 configured
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per RFC 8555 §7.3.3, when an ACME provisioner has termsOfService configured,
the server should reject newAccount requests that do not set
termsOfServiceAgreed to true, returning a userActionRequired error.

Closes #2539
---
 acme/api/account.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/acme/api/account.go b/acme/api/account.go
index 3114dcb35..5068ec95f 100644
--- a/acme/api/account.go
+++ b/acme/api/account.go
@@ -102,6 +102,12 @@ func NewAccount(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if prov.TermsOfService != "" && !nar.TermsOfServiceAgreed {
+		render.Error(w, r, acme.NewError(acme.ErrorUserActionRequiredType,
+			"terms of service must be agreed to; see %s", prov.TermsOfService))
+		return
+	}
+
 	httpStatus := http.StatusCreated
 	acc, err := accountFromContext(ctx)
 	if err != nil {