15 files changed, 87 insertions, 76 deletions
diff --git a/Changelog b/Changelog
index 5c91365..358c53a 100644
--- a/Changelog
+++ b/Changelog
@@ -1,10 +1,22 @@
+lacme (0.8.4) upstream;
+
+  + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses.
+    This change is needed for compatibility with Crypt::OpenSSL::RSA 0.38
+    and later.
+  + Fix 'drop-privileges' test.
+  + Update test suite to match staging server behavior.
+  + Drop OCSP must-staple extension test which is no longer available on
+    Let's Encrypt's ACME server.
+
+ -- Guilhem Moulin <guilhem@fripost.org>  Mon, 20 Jul 2026 19:52:28 +0200
+
 lacme (0.8.3) upstream;
 
-  + Fix post-issuance validation logic.  We avoid pining the
+  + Fix post-issuance validation logic.  We avoid pinning the
     intermediate certificates in the bundle and instead validate the
     leaf certificate with intermediates supplied during issuance as
     untrusted (used for chain building only).  Only the root
-    certificates are used as trust anchor.  Not pining intermediate
+    certificates are used as trust anchor.  Not pinning intermediate
     certificates is in line with Let's Encrypt's latest recommendations.
   + Pass `-in /dev/stdin` option to openssl(1) to avoid warning with
     OpenSSL 3.2 or later.
diff --git a/client b/client
index 2a5ee3c..be9a7f5 100755
--- a/client
+++ b/client
@@ -43,7 +43,7 @@ use warnings;
 # instance own by another user and created with umask 0177) is not a
 # problem since SOCKET_FD can be bound as root prior to the execve(2).
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $PROTOCOL_VERSION = 1;
 my $NAME = 'lacme-client';
 
diff --git a/debian/changelog b/debian/changelog
index ca3e7b3..6087f7f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,19 @@
+lacme (0.8.4-1) unstable; urgency=medium
+
+  * New upstream bugfix release.
+    + accountd: Use PKCS#1 v1.5 signatures, as it's what JWT RS256 uses.
+      This change is needed for compatibility with libcrypt-openssl-rsa-perl
+      0.38 and later.
+  * d/control: Remove `Rules-Requires-Root: no`.
+  * d/watch: Port to Version 5.
+  * Update Standards-Version to 4.7.4.
+    + Remove "Priority: optional" which is the current default and spelling it
+      out is no longer recommended per Policy.
+  * d/u/signing-key.asc: Upgrade to new packet format.
+  * Refresh d/patches.
+
+ -- Guilhem Moulin <guilhem@debian.org>  Mon, 20 Jul 2026 19:56:11 +0200
+
 lacme (0.8.3-1) unstable; urgency=high
 
   * New upstream bugfix release.
diff --git a/debian/control b/debian/control
index 5854a15..d86f01f 100644
--- a/debian/control
+++ b/debian/control
@@ -1,10 +1,8 @@
 Source: lacme
 Section: utils
-Priority: optional
 Maintainer: Guilhem Moulin <guilhem@debian.org>
 Build-Depends: debhelper-compat (= 13), dh-sequence-installsysusers, jq, pandoc (>= 2.1~)
-Rules-Requires-Root: no
-Standards-Version: 4.7.0
+Standards-Version: 4.7.4
 Homepage: https://git.guilhem.org/lacme/about/
 Vcs-Git: https://salsa.debian.org/debian/lacme.git -b debian/latest
 Vcs-Browser: https://salsa.debian.org/debian/lacme
diff --git a/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch b/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch
index 24fad20..2937296 100644
--- a/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch
+++ b/debian/patches/Mention-the-Debian-BTS-in-the-manpages.patch
@@ -26,7 +26,7 @@ index 4933a78..272cd52 100644
  ========
  
 diff --git a/lacme.8.md b/lacme.8.md
-index ad6dab6..33d7e11 100644
+index 65f1c36..31ebcca 100644
 --- a/lacme.8.md
 +++ b/lacme.8.md
 @@ -499,6 +499,12 @@ restrictions:
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc
index 8afec53..9815f7d 100644
--- a/debian/upstream/signing-key.asc
+++ b/debian/upstream/signing-key.asc
@@ -1,6 +1,6 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 
-mQINBFCXIGYBEADjtahMDYeKpR3aovhSymGabaQFtQMb4idCCZBXcm/QL6QbdCtl
+xsFNBFCXIGYBEADjtahMDYeKpR3aovhSymGabaQFtQMb4idCCZBXcm/QL6QbdCtl
 RGF3FoTeYPxk7wmcAqpA3JV2Hkc0tB+pWOaDJTJFEasNuUlIzcaFnr2VqsLRLiTP
 LWNlnSLbUb8EtyUyaj5qkZY2e0LAUrNXGspNEqTOJUE3j8KXLpxXadjmDKDD4Z8o
 P2X1Qxb2VnNmJ6/T4lpCdTKpQE8gG8qpq2oQXuqoiezO6pudohimvVsKUTXcumlk
@@ -11,7 +11,7 @@ tteyDH9nU/yvJ9pCsn5flR3jJCNC35AoxJnONZ0KKcVzzdcMG9uCf+PzH1gJi2f/
 Y1yPr8a5kNltKL2jVs5Nut8R8i2UngjipMTWFFP+eJlJm3aQl9EbL31G9j0GnR4Y
 TZFk+MuTSqmZ4ZAzimT7ffDCIZQymrYyGGpJjdJP6bh/KcAZtrAdcj77CKlz0A+Q
 aaJ9hCtERjy2DSn+UqAGdcln7fdaMJ9TrqqAa03wO/QIU5MgJpH14HdHQQARAQAB
-tA5HdWlsaGVtIE1vdWxpbokCVwQTAQoAQQIbAQULCQgHAwUVCgkICwUWAgMBAAIe
+zQ5HdWlsaGVtIE1vdWxpbsLBlwQTAQoAQQIbAQULCQgHAwUVCgkICwUWAgMBAAIe
 AQIXgAIZARYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJ7ABQkRN9JaAAoJEDkn
 jagQnmJEExoP/jxRyCFWVWt70M2hPG0TWQ37AFTBghVzzAzCDWHJzJJzGc+XDb1d
 AvOFkodli09eKv4lA4CVCwQT7fXgzHZegKfSSttgpArH+OByiQMtV2RwfYnnrpJj
@@ -23,8 +23,8 @@ arsm37XRemVcgZJqNYGJMzrEYVsNWpYH0TX/MMkGGVpB9wun0ylKN9NTlVrmYjMT
 HSp8g6/jrGmMnrWtsRsfgZ0aFwggxKRGSXvXl3p/kvCLB04Dt0hjrbGn7kOZq4s4
 VneMLDoLNWmEQTXbpMmcuUneCe8OH8sT7f3/StVSHtoeBycnJG7ITZZRg4VvjLU2
 fmK+03f1JWMektFwEwt1u9wjQNMXRYSRqA9EgkHVuGHdWw+DLsi0V5s3hjhBdCvq
-lGcDILiUM8hHi72tEKeGx7FKdiF2mgY9C+Gb5WArRI9juAPonWe2ofwutCRHdWls
-aGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz6JAlQEEwEKAD4CGwEFCwkI
+lGcDILiUM8hHi72tEKeGx7FKdiF2mgY9C+Gb5WArRI9juAPonWe2ofwuzSRHdWls
+aGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz7CwZQEEwEKAD4CGwEFCwkI
 BwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFaRY3OmXY5J42oEJ5iRAUCXZCe
 wAUJETfSWgAKCRA5J42oEJ5iRBGMEACHG+IxN3/GwROdJmJEmtAFG5i8SgIbXe5M
 OpyYxojL4JUCZ9hB1dDm7nMSCvHzfrxIBOeK0hqKeUBWV1vwgiKA0o0ba+LNYezI
@@ -37,8 +37,8 @@ B+ZGJJB8ktcKvu1Uc2w7WOigLICI6iim9lU7Ot27l4c+eDbUO0bf5NnlJeQTa+Q6
 BHNmy5l+uuvL3PHl/BAlqYa4IvJPBMLl/H5AugbCBx40kSYo50AJdZ2Kt7bpXcoq
 Ex78gFLriFziYYUjqJaNx1DjeTvYE+hCDR2M5DTd3PO2PCeGVpe5IZpPaNusdwg6
 ubreTpWCZft3O1tJoyui4qEChGKVjV5juZIHNhdrXnnW8q+gzIfm221CQHG3R3zX
-YtRHhVTOurQrR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0ubW91bGluQGNoYWxtZXJz
-LnNlPokCHwQwAQoACQUCV35wugIdIAAKCRA5J42oEJ5iRFB7D/44uGGQbYaxwWo9
+YtRHhVTOus0rR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0ubW91bGluQGNoYWxtZXJz
+LnNlPsLBXwQwAQoACQUCV35wugIdIAAKCRA5J42oEJ5iRFB7D/44uGGQbYaxwWo9
 mfzpkS2T3EVpwPzTasuEHB4E4prpP2UYjJP3f0i18K+rVYReHqp8LOXVQvg2HMsr
 EOHoSvdhuZq56glXWyTslCAOQGTc/AbFj/K2C72PhzoaS6Oq5hM4AW6ilMSGbEPR
 rr/Ys7oMhuLv0dlVYOZpcALeDO4c4sXK/XJnAOJgCbHPD+Miw+JSKZzMfQKmNenY
@@ -49,8 +49,8 @@ MLSueddRo+KpGO6FlPI3vRnfDAi0WSdENWAzfEaz3K/ZuodaTzwy35Dg3wxGwHxD
 Y/b11XRwBHjn//Z1hBhw+2Rw7iIFSYMikpMVSZqNDDOcXJ2UXT49f9c3SC7xXz1U
 qJqtvxgS5He1D7pNUP0mrOsETsk4W3cl15Z1tlb6iiWkrK9ZSLIWBxOZSWp5YxVh
 MLssbMAzW3blyKZzAn12Am3ap40Pb0KJBA4cUHKV/Gj3JnSP9CDr0kTerlJKeIga
-wRSc+84HpHHPc/xVxbwFHyzfFN7C+bQrR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0u
-bW91bGluQGZyaXBvc3Qub3JnPokCUQQwAQoAOwUCVmx7AjQdAFN1YnN1bWVkIGJ5
+wRSc+84HpHHPc/xVxbwFHyzfFN7C+c0rR3VpbGhlbSBNb3VsaW4gPGd1aWxoZW0u
+bW91bGluQGZyaXBvc3Qub3JnPsLBkQQwAQoAOwUCVmx7AjQdAFN1YnN1bWVkIGJ5
 ICJHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBmcmlwb3N0Lm9yZz4iAAoJEDknjagQ
 nmJESF0QALfe4R+HP+L8ScT4msHjhc6bqlJkckaYO4An7mNUe7IEMoRirYET226x
 9Ftc6PGPIaUPTg+xE/t2c8Jx3a929/kHeDE2VRqn8ANYICphDKF/W+Drviw/fKd6
@@ -62,8 +62,8 @@ dLfRLsEe58sj2iwmEIxXQX2yPiy7J09L3vDcLJl2l/6Oz6U0xEEyc9jN/QdXcsMK
 WcrtkCY4imUHDulzBoPtusIqYoccHPTkxoENRmEWtcTp7iZthhY8IxUpbFW/V92U
 WsVw87Z6MkYiwSxgeVtLxYPd8qdMAYQY3ehFStoNJnJR03PW+CZwGsIp1EntL0K1
 huC8yq23N4rfUkV56EDQjDUWeEGbmwY5knYF1SMWD1eftXDhs8HeuqrPJ7MgHK8Z
-+PmcCsOjl472gaNnf6unGASbSZ47mXMH35amLnIKwI1w4E0GoUbKtCxHdWlsaGVt
-IE1vdWxpbiA8Z3VpbGhlbS5tb3VsaW5AZW5zLWx5b24ub3JnPokCVAQTAQoAPgIb
++PmcCsOjl472gaNnf6unGASbSZ47mXMH35amLnIKwI1w4E0GoUbKzSxHdWlsaGVt
+IE1vdWxpbiA8Z3VpbGhlbS5tb3VsaW5AZW5zLWx5b24ub3JnPsLBlAQTAQoAPgIb
 AQULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBHQg34a84VpFjc6ZdjknjagQnmJE
 BQJdkJ7ABQkRN9JaAAoJEDknjagQnmJEP4EP/Rn1ImI75n/owCQGMdqiOfZpcXv3
 wYnhME/3vAnxBoTvyLeVRAzEycUFTSl/Pzc8Ncu/WfmZ7eDDXKtgFIdNxJPAwz8k
@@ -76,8 +76,8 @@ C4sMcpplG4zpEcz3PpOWFRbjRoL/XXQX1p/1gQYDt0cjF5Q5YPB8+JxluahQR2Tx
 RIdHiJphl/ctQbQtO5/e2/GkEvrlIBl1ymFrnXiQlPa9zaWJPz5iYEdoYwGFcqT8
 q8KXhDUkrZ/j4857ztOuJJmI1BlZ4e10zjfDBHKOh389D+RJ3MrHkXhvvwxbyy+A
 LHqF5HV/BUz/d9ZLC6sXjcUjMMLOelT9odSN9iuNlLi/W+Pd1Rj5Qgylvz8AfILH
-iphNiwR2Ik+AsX1MtCRHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBndWlsaGVtLm9y
-Zz6JAlQEEwEKAD4CGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFa
+iphNiwR2Ik+AsX1MzSRHdWlsaGVtIE1vdWxpbiA8Z3VpbGhlbUBndWlsaGVtLm9y
+Zz7CwZQEEwEKAD4CGwEFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFa
 RY3OmXY5J42oEJ5iRAUCXZCewAUJETfSWgAKCRA5J42oEJ5iRJC0D/wK7yX/AdmI
 6Bo+r7/H3iDn3WoNNjIybfgnTsQ0k0DtMVim8LbjEhfUQXGhZOJh6MmG5IG+6ixM
 Ih4VjPlyia53L6mHO+PNA6M4+VyeCErboBl8OfURzAmPBLA0PkojO2o4gDD8k6aD
@@ -89,8 +89,8 @@ rr9NpG1wopJ6WmyjbFF7q6LHXiMr+zwSnce1OY8slT2Olv+woHTkz9QEW3o8jBRZ
 8cQkIIbnqP4oO79gzI8r0Vf2P9sKh41roBKR9jNqagKkQS7c/7bqzzMfWLItlv+0
 8ayaNYfvBi9jLCMKmzPE0trrZIOscRMlugRxGewcCkFSG5tXZCk0xN6h/861ON3F
 qagbD28ZMyXyyezTTxBcNsMSMpTKI9ZuBQN5oRtO06Krjn5LaBmOtRfQthchZ/eV
-lXCI5I4fwS3x82stlDejHgUQ2gCyaJ0kfbQoR3VpbGhlbSBNb3VsaW4gPGd1aWxo
-ZW1AbGlicmVvZmZpY2Uub3JnPokCUwQTAQoAPQIbAQQLCQgHBRUKCQgLBRYCAwEA
+lXCI5I4fwS3x82stlDejHgUQ2gCyaJ0kfc0oR3VpbGhlbSBNb3VsaW4gPGd1aWxo
+ZW1AbGlicmVvZmZpY2Uub3JnPsLBkwQTAQoAPQIbAQQLCQgHBRUKCQgLBRYCAwEA
 Ah4BAheAFiEEdCDfhrzhWkWNzpl2OSeNqBCeYkQFAl2QnsEFCRE30loACgkQOSeN
 qBCeYkSsfg//da0Uj/vsNFmfVpv0JcRUVyxX1MRCOHcVwNQPW+NgpipELQ5lY9+y
 ti2XG6y3JG05QUs2ygOOyDqQQSIXzrMphKQIvG5cay9w2f7BHjB08X/pIJzqP/cs
@@ -102,8 +102,8 @@ rMJHOE1DzxuaNnfXxHB/pejruyp27UF/OCi1NAd/x5vpM7QrIR8s9T24WEXZOD11
 aNNqrYsrZVSG3QGx5s/kJckHBgxrxRSpLKMOwPhXtp9VPNJpWiFtM3a0AcH3VjuU
 cXMRjG/PAFjEC6/ymXpO6xJDDKg3iD1sKk2pe8m36NHgMkT8yHe0yYF3qdC99aFN
 l1kH0S1KEAXj7nxrUFYqbTvhc4saHojHItRCE4PjpOvrAehg8bcZ58tmPeVmo+lz
-qoQAmHpnaXV612NdyshK85b5dt7kSA5+nw46wrrSZqz/3NSEmvMUA+q0I0d1aWxo
-ZW0gTW91bGluIDxndWlsaGVtQGRlYmlhbi5vcmc+iQJTBBMBCgA9AhsBBAsJCAcF
+qoQAmHpnaXV612NdyshK85b5dt7kSA5+nw46wrrSZqz/3NSEmvMUA+rNI0d1aWxo
+ZW0gTW91bGluIDxndWlsaGVtQGRlYmlhbi5vcmc+wsGTBBMBCgA9AhsBBAsJCAcF
 FQoJCAsFFgIDAQACHgECF4AWIQR0IN+GvOFaRY3OmXY5J42oEJ5iRAUCXZCewQUJ
 ETfSWgAKCRA5J42oEJ5iRLncEACgG5hc4Rj713tUjISVbox76suWaks8Fs77OFQA
 WIbu21yzLiTwhnU4as8cSGN0x/FUsWSpfAxtSsYlUtFaPfT4nxT5IthYZ2PL6RYc
@@ -116,7 +116,7 @@ TQLgf2truHd8wERHZ7CjOM2X4Buqx1rHHSouL7S/gRf+XnvtU/kc2fj9VtEJpB8f
 WcDXHKnm206+w8JTSVti6vOpWmTo8iO9Vcdi/NiKOwNg8DNITtcIxLgI54H1AP3y
 7f1IUuKaDB/ITveSUBRqVtVEWlNUy9pbVqOJrAIjl7E9ouRu/QwTKM7XcWn3aJNa
 oQje1U24k3B4hhiPPcM/K2YwF8fnU+LOW/uvpF5cWWWELEsR+B47EnS0dX5SfVCw
-+Xl8rLkCDQRQlyERARAAzi+R39PEKV7sLncMEvWHQTTGSUNRSD4hEOhB+PVhOUmj
++Xl8rM7BTQRQlyERARAAzi+R39PEKV7sLncMEvWHQTTGSUNRSD4hEOhB+PVhOUmj
 DSwglgGDZ4wfjKmmmgHREIGSan6bXOXW38Iepc+XB3NuGgMZHgo55mmRJydDqFC2
 HP41Cruu91mOkOyTLbyg4lM7efi24xc3BPuxV4uFsEKaHUdhRTqiETxRTXqQCooq
 UeWsDZdc7uJUtdV70T7H8n/YHRtJnCue1r8QZP03Vzuav0KXB2ad4aqTAYeZz4C0
@@ -127,7 +127,7 @@ uTwjwcnaFz6/9EEAN8b1I9e74eXkSaSLHxyb53EsiX8nVEvYPDw0Eq2bgc/OXiR3
 p4AyW2QIAbHy4K1KP3GLmy7tLl5a9Vzra5EvCtxnyBzSN5Ca2vyWTzh41yf++8fq
 BMoV/zvRz1nZ9MbajNXMPuf2wFLxLzDV8vB5TPmf1P5PQtkS/Tie6x57LpeS1bJl
 0vs+8MdWAvnpxFX6L3lIq3r7oXnlJceO5VapMkdm9eH1adpr4Ef/zt7B2k98s5MA
-EQEAAYkEWwQYAQoAJgIbAhYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJmsBQkR
+EQEAAcLDmwQYAQoAJgIbAhYhBHQg34a84VpFjc6ZdjknjagQnmJEBQJdkJmsBQkR
 N8ybAinBXSAEGQEIAAYFAlCXIREACgkQ05pJnDwhpVJVhhAAhoyf+ONzqGNacWB1
 kWQlmuyPmraoLiGk9hY/TRr9g6g4VHqRffmaW+iqUmBKb4xiRkAZ+YEftruDudsH
 yJsVyw181mkHLvPLf4wc/Ywaz+O5rY+/jO52w5T+Yx5zxVbuHnL1Z2YqINvbPWrU
@@ -150,7 +150,7 @@ HhTjuQFPExUDzP4fogrIW9NyLBMe6S7NSVhFk7OeiHC/QF1deWWBlfzknJ1oyIID
 bUUYlVUGPyUQgRlBazXPxKIVhXcJ0k2sHu3rUEpdu8aa9nU9vdMrqgLHvcDqwylp
 q3iFLu7wjn1SUOra7BLUVnTJRKy5ie3X4RYCaq1jzgE19KyoDI5amIt4YgMj160z
 8F/ycEiVGj2bcwMus+fyHQo6TkYDTudW5hcLyH1XkpXIVNx5WuoMyJWSXwIrEq96
-e2oWfvwOesN3w08V+HWPd5mRuQINBFCXIWkBEADYqxLU/iHbhzsFh0uRw4XwVhaw
+e2oWfvwOesN3w08V+HWPd5mRzsFNBFCXIWkBEADYqxLU/iHbhzsFh0uRw4XwVhaw
 mUsWSXycQp9bn+aDG9oTb/VYgQDpHEwEX3uba4qCSeOdV9Vs2aksz7xI4wNUFjrI
 IpzkPJth1bu2qbUYtezgq0HMuS2w/BbnuoNbvBTKl5vEjE1/AmLyP9tMpSZjBIqP
 KdxtkK0np3NOxjd00Dj+YceRKa2SZU0ueqh+VQyzfaTfupMMNuI0DpN1Q6rjr2is
@@ -161,7 +161,7 @@ f0ryBNE32ZPIevRNJT/SVDJIpt0JARzVdKpkQG8eKnH1EHngQDEnBCPYOrL3rOxN
 OVqoWBy2DUkHpvhCnowND1W+t3ya/rXEzfEq3SOc34T/wcclGJdJtkTS417ix1ix
 eEl7IbDqv5i3vXKpPk+O6t30Sk5QZpQu+fanlJJAjZStZJn1bbNFOx8X1r738STk
 6mhqT8+8Z/4ciFG7fnH4AQW+mAZJ8Zndvz7PvVwj+GVw49utmwDzCChHgSwDl+eU
-WJE6Ig01JoszE7zXHwARAQABiQI8BBgBCgAmAhsMFiEEdCDfhrzhWkWNzpl2OSeN
+WJE6Ig01JoszE7zXHwARAQABwsF8BBgBCgAmAhsMFiEEdCDfhrzhWkWNzpl2OSeN
 qBCeYkQFAl2QmbgFCRE3zEMACgkQOSeNqBCeYkToJA/+LgryFWW746I7i2Zc3JOU
 Y9y8rBb+c+ZY54aBQYJO0QQ3las3pxgbLDuRL8IyF0DKAxTw0GbOgFDnORZuI51f
 Q49ND7I673aPX+f5tHgEwpR53DtRjdhqQ1RHzZ4sXjUQiEPSd/NgbSi/Rw8I3ROh
@@ -173,7 +173,7 @@ TzaRlnr9IhFyZqASokSVaPmvR9oHCQEjP/cBQR2sRQm4gqKMHr7gIb1DmIxrewJB
 vGJGuoF8+cwPGxA5kZXUDGzSJScm/zU9w70voHJ62onFEth4iI93S6ssinNu7sOo
 V91FFLZ89xvzCCslX1VDGRcUaxB0AKET5ahQOnB7nEGv6v6yFhrlVGS+93ryseel
 frEG3yBwdjhYO8JGrIA5HJP8Q6sqo747sq5UfVc+8eRZotPfjykuouCe646uvwB6
-lEqmVWVRUYtqmZpHLjim4zS5Ag0EUJchrwEQALOrqpCPddr8PPTdRBmSGorqwdmk
+lEqmVWVRUYtqmZpHLjim4zTOwU0EUJchrwEQALOrqpCPddr8PPTdRBmSGorqwdmk
 TUHPNRd36VbQJPJt0/8ZAJh6J5KZo9Bzv0nE07Iwcz5bev7iCM9dTR0UaLj7zlS+
 VwFbdUmjfxie8iIlZB4l3pmKXShag9zJTYyt/0HUU3RytJoiGigsVX1O/qNSM+QW
 xrPGsIg8YmRSbQ3PwOsc4udEAqL2/pZni+raf/TAS8SQbJHm2K9ebHSQ8ZBbvap0
@@ -184,7 +184,7 @@ ms0RXMuxmdwioWYHE5wChNZQocnHb2fnwuAmoZzRj7IZzcsZvYPpT6Ld/dKWVnIM
 WaZ3vsQx4yF2morULH0Yrb4wrXzK1vASDRgW9G2Im/y7woZn609r3LNA2ELioEHF
 j1hQyd1wqgIRXDvs9ltM4xZusEO7McS9yF/Ywm8EjWaWznabD/OOo8ul1NzR2sKi
 qojCyOgcPYp4udK0e7+4FntKEiallyuFQjbA6RGzZsnsJ28Uyb3qfQCQJyzRL+cT
-dlCM92EwfgHVnJPXABEBAAGJAjwEGAEKACYCGyAWIQR0IN+GvOFaRY3OmXY5J42o
+dlCM92EwfgHVnJPXABEBAAHCwXwEGAEKACYCGyAWIQR0IN+GvOFaRY3OmXY5J42o
 EJ5iRAUCXZCZuAUJETfL/QAKCRA5J42oEJ5iREW1D/9k29b863oG1q1nx11AanNN
 uquJ0MVqHEQQx/enoYHG55IrRvtx5tZ/sHXzSEM+hY6YX4SkpGhrxNl2mFpevp65
 n5cmzMsHfscT4U91NkzALoeSkfuDksp2zfi+90F+iiEwst+Btj9tChk5AWkBC7vJ
@@ -196,8 +196,8 @@ OzD+Im+Le+N/qPzP214GwsBm/uJNH1hjhtiGuCSDPYWhrKBsqBxfhiYXeCOv2nx9
 qcku1lwBD2lTAFbgp4P0EZ8mXPsDyB24Z5UH4CgWv1hOGpU37T6NIHWaX8uUyPhT
 4mIKIZ3Z6/dmnT4qE+Pric2epTMKTUXEovwYPff9Kz3ByvEA8rHJSMkVI8Pvyyao
 BlCCKxX0EOiDLZ7c950YpuaH+Q7G67v4i1O8KmutwLmrk4Hb7uOQehz0V0Ue3Us/
-n+OxhhD1zJxbBrRR+vtDH7gzBFd+ceAWCSsGAQQB2kcPAQEHQP43gROo1fKfPOpX
-g3CvCe3a3xd4AuJxSkTk0vs/+YDyiQI8BBgBCgAmAhsgFiEEdCDfhrzhWkWNzpl2
+n+OxhhD1zJxbBrRR+vtDH84zBFd+ceAWCSsGAQQB2kcPAQEHQP43gROo1fKfPOpX
+g3CvCe3a3xd4AuJxSkTk0vs/+YDywsF8BBgBCgAmAhsgFiEEdCDfhrzhWkWNzpl2
 OSeNqBCeYkQFAl2QmbgFCQpQe8wACgkQOSeNqBCeYkRO2w/8Dd3Z/a7Y9wjRHklB
 5QHoMiv2zcBV4B4wTA5RHce6+NPnkK5CV8K7oP1RKvu8aWSfSgyD+Nu5f85gRY1c
 NpLQmGZrsAX/tBVbVIuB2/4aI6RFf30YLl7WuhonCf85czs5sBcRwIW1SCkgQI30
@@ -210,5 +210,5 @@ Zq6ysU8S9raXk1QtqOyV9FCW22ItGrwQT+xsPkrLWRyqaRbHILI+1lLLFTmWjnsW
 aWUlY8E8Q7rVYr3ga8acxSMVSqBgFKLqWbaWuwTGAP37ARKgpyz7tlFRd34mm04J
 nIRjBn08lLwMSW/CtK/jxwl9vouGQ9dgtRqvPSfOKYjJQTEwLzdlESD0yCbqF+lJ
 GJEHV3ge20qUwbV/0n1xVgRnKAM=
-=R/AC
+=jenJ
 -----END PGP PUBLIC KEY BLOCK-----
diff --git a/debian/watch b/debian/watch
index 518a123..5dc7632 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,3 +1,6 @@
-version=4
-opts="mode=git,pgpmode=gittag" \
-https://git.guilhem.org/lacme/ refs/tags/v([\d\.]+)
+Version: 5
+
+Source: https://git.guilhem.org/lacme/
+Matching-Pattern: refs/tags/v([\d\.]+)
+Mode: git
+Pgpmode: gittag
diff --git a/lacme b/lacme
index 37d3a51..c72628c 100755
--- a/lacme
+++ b/lacme
@@ -22,7 +22,7 @@ use v5.14.2;
 use strict;
 use warnings;
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $NAME = 'lacme';
 
 use Errno 'EINTR';
diff --git a/lacme-accountd b/lacme-accountd
index 5bc8b5f..05fa227 100755
--- a/lacme-accountd
+++ b/lacme-accountd
@@ -23,7 +23,7 @@ use v5.14.2;
 use strict;
 use warnings;
 
-our $VERSION = '0.8.3';
+our $VERSION = '0.8.4';
 my $PROTOCOL_VERSION = 1;
 my $NAME = 'lacme-accountd';
 
@@ -174,6 +174,7 @@ if ($OPTS{privkey} =~ /\A(file|gpg):(\p{Print}+)\z/) {
     error("$filename: Not a private key") unless $rsa->is_private();
     error("$filename: Invalid key")       unless $rsa->check_key();
     $rsa->use_sha256_hash();
+    $rsa->use_pkcs1_padding(); # JWT RS256 uses PKCS#1 v1.5 signatures
 
     require 'Crypt/OpenSSL/Bignum.pm';
     my ($n, $e) = $rsa->get_key_parameters(); # don't include private params!
diff --git a/tests/accountd-kid b/tests/accountd-kid
index 8a4b53c..e6f5ca4 100644
--- a/tests/accountd-kid
+++ b/tests/accountd-kid
@@ -28,7 +28,7 @@ sleep 1
 # newAccount resource fails as per RFC 8555 sec. 6.2 it requires a JWK
 ! lacme --socket="$SOCKET" account 2>"$STDERR" || fail
 grepstderr -Fxq "Warning: lacme-accountd supplied an empty JWK; try removing 'keyid' setting from lacme-accountd.conf if the ACME resource request fails."
-grepstderr -Fxq "400 Bad Request (Parse error reading JWS)"
+grepstderr -Fxq "400 Bad Request (Unable to validate JWS :: Parse error reading JWS)"
 grep -F "] SIGNED header=base64url({" ~lacme-account/.local/share/lacme/accountd.log >/tmp/signed
 ! grep -vF "] SIGNED header=base64url({\"alg\":\"RS256\",\"jwk\":{}," </tmp/signed
 
@@ -48,7 +48,7 @@ test /etc/lacme/simpletest.rsa.crt -nt /etc/lacme/simpletest.rsa.key
 lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt
 ! lacme --socket="$SOCKET" revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Eq "400 Bad Request \\(Unable to revoke :: no certificate with serial [0-9a-fA-F]+ and status other than revoked\\)"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt"
 
 kill $PID
diff --git a/tests/cert-extensions b/tests/cert-extensions
index d7e7855..9c5b977 100644
--- a/tests/cert-extensions
+++ b/tests/cert-extensions
@@ -25,7 +25,7 @@ x509_check /etc/lacme/test1.crt <<-EOF
 	X509v3 Key Usage: critical
 	    Digital Signature, Key Encipherment
 	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
+	    TLS Web Server Authentication
 	X509v3 Basic Constraints: critical
 	    CA:FALSE
 	X509v3 Subject Alternative Name:
@@ -54,38 +54,11 @@ x509_check /etc/lacme/test2.crt <<-EOF
 	X509v3 Key Usage: critical
 	    Digital Signature, Key Encipherment
 	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
+	    TLS Web Server Authentication
 	X509v3 Basic Constraints: critical
 	    CA:FALSE
 	X509v3 Subject Alternative Name:
 	    DNS:$(echo "$commonName" "$subjectAltName" | tr " " "\\n" | sort -u | paste -sd" " | sed -r "s/ /, DNS:/g")
 EOF
 
-# tlsfeature
-openssl genpkey -algorithm RSA -out /etc/lacme/test3.key
-commonName="$(head -c10 /dev/urandom | base32 -w0 | tr "A-Z" "a-z").$DOMAINNAME"
-cat >"/etc/lacme/lacme-certs.conf.d/test3.conf" <<- EOF
-	[test3]
-	certificate-key = /etc/lacme/test3.key
-	certificate-chain = /etc/lacme/test3.crt
-	subject = /CN=$commonName
-	tlsfeature = status_request
-EOF
-
-lacme newOrder test3
-test /etc/lacme/test3.crt -nt /etc/lacme/test3.key
-x509_check /etc/lacme/test3.crt <<-EOF
-	subject=/CN=$commonName
-	X509v3 Key Usage: critical
-	    Digital Signature, Key Encipherment
-	X509v3 Extended Key Usage:
-	    TLS Web Server Authentication, TLS Web Client Authentication
-	X509v3 Basic Constraints: critical
-	    CA:FALSE
-	X509v3 Subject Alternative Name:
-	    DNS:$commonName
-	TLS Feature:
-	    status_request
-EOF
-
 # vim: set filetype=sh :
diff --git a/tests/cert-revoke b/tests/cert-revoke
index 179ccba..ead6723 100644
--- a/tests/cert-revoke
+++ b/tests/cert-revoke
@@ -18,7 +18,7 @@ test /etc/lacme/simpletest.ecdsa.crt -nt /etc/lacme/simpletest.ecdsa.key
 lacme revokeCert /etc/lacme/simpletest.ecdsa.crt
 ! lacme revokeCert /etc/lacme/simpletest.ecdsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.ecdsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Fq "400 Bad Request (Unable to revoke ::"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.ecdsa.crt"
 
 # and the RSA certificate using the service key
@@ -26,7 +26,7 @@ mv -vfT /etc/lacme/simpletest.rsa.key /etc/lacme/account.key
 lacme revokeCert /etc/lacme/simpletest.rsa.crt
 ! lacme revokeCert /etc/lacme/simpletest.rsa.crt 2>"$STDERR" || fail
 grepstderr -Fxq "Revoking /etc/lacme/simpletest.rsa.crt"
-grepstderr -Fq "400 Bad Request (unable to revoke"
+grepstderr -Fq "400 Bad Request (Unable to revoke ::"
 grepstderr -Fxq "Warning: Couldn't revoke /etc/lacme/simpletest.rsa.crt"
 
 # vim: set filetype=sh :
diff --git a/tests/cert-verify b/tests/cert-verify
index a6cd336..2138e29 100644
--- a/tests/cert-verify
+++ b/tests/cert-verify
@@ -20,7 +20,7 @@ grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from
 # verification error for unrelated CA bundle
 cat /etc/ssl/certs/ssl-cert-snakeoil.pem >/usr/share/lacme/ca-certificates.crt
 ! lacme newOrder 2>"$STDERR" || fail
-grepstderr -Fxq "error 20 at 1 depth lookup: unable to get local issuer certificate"
+grepstderr -Eq "^error 20 at [1-9][0-9]* depth lookup: unable to get local issuer certificate$"
 grepstderr -Fxq "[simpletest-rsa] Error: Received invalid X.509 certificate from ACME server!"
 
 # use saved bundle as custom CAfile
diff --git a/tests/drop-privileges b/tests/drop-privileges
index 8deb8f1..3589ee3 100644
--- a/tests/drop-privileges
+++ b/tests/drop-privileges
@@ -81,7 +81,8 @@ check_accountd() {
 		USER=lacme-account
 	EOF
 
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stderr" || return -1
     socket_ino="$(sed -rn '/^0 .* socket:\[([0-9]+)\]$/ {s//\1/p;q}' "$prefix/fd")"
     [ -n "$socket_ino" ] || return 1
     grep -Fxq "0 0700 $UID:$GID socket:[$socket_ino]" "$prefix/fd" || return 1
@@ -106,8 +107,10 @@ check_client() {
 		USER=_lacme-client
 	EOF
 
-    stdout="$(readlink -e "/proc/$$/fd/1")"
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stdout="$(readlink -f "/proc/$$/fd/1")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stdout" || return -1
+    test -n "$stderr" || return -1
     if [ "$command" = "account" ]; then # no pipe
         grep -Fxq "0 0500 $UID:$GID /dev/null" "$prefix/fd" || return 1
         grep -Fxq "1 0700 $UID:$GID $stdout"   "$prefix/fd" || return 1
@@ -143,8 +146,10 @@ check_webserver() {
 		USER=_lacme-www
 	EOF
 
-    stdout="$(readlink -e "/proc/$$/fd/1")"
-    stderr="$(readlink -e "/proc/$$/fd/2")"
+    stdout="$(readlink -f "/proc/$$/fd/1")"
+    stderr="$(readlink -f "/proc/$$/fd/2")"
+    test -n "$stdout" || return -1
+    test -n "$stderr" || return -1
     grep -Fxq "0 0500 $UID:$GID /dev/null"  "$prefix/fd" || return 1
     grep -Fxq "1 0700 $UID:$GID $stdout" "$prefix/fd" || return 1
     grep -Fxq "2 0700 $UID:$GID $stderr" "$prefix/fd" || return 1
diff --git a/tests/old-accountd b/tests/old-accountd
index 3ad4b31..daa1996 100644
--- a/tests/old-accountd
+++ b/tests/old-accountd
@@ -19,6 +19,9 @@ DEBIAN_FRONTEND="noninteractive" apt install -y --no-install-recommends \
     -oDPkg::Options::="--force-confdef" -oDPkg::Options::="--force-overwrite" \
     lacme-accountd/stretch
 
+# somewhat cheating, but needed for an older accountd using a newer Crypt::OpenSSL::RSA
+sed -ri 's/^\s*\$rsa->use_sha256_hash\(\);$/& $rsa->use_pkcs1_padding();/' /usr/bin/lacme-accountd
+
 SOCKET=~lacme-account/S.lacme
 runuser -u lacme-account -- lacme-accountd --socket="$SOCKET" & PID=$!
 sleep 1