When using Infisical as an ACME Certificate Authority for Traefik, the ACME client fails during EAB account registration with a Base64 decoding error. The same EAB secret works when pasted directly into the Traefik configuration file, but fails when passed via Docker Compose environment variables.
Expected behavior
When a user retrieves the ACME EAB credentials from Infisical and configures a compatible ACME client {Traefik/lego)with those credentials, the client should be able to successfully register an account with Infisical’s ACME server without any manual encoding or transformation of the EAB Secret.
Specifically:
EAB Secret should be usable as-is. The value revealed by Infisical’s “Reveal ACME EAB Secret” dialog should be directly copy-pasteable into any standard ACME client’s EAB configuration without requiring the user to understand or apply Base64 encoding transformations.
EAB Secret should be compatible with Base64 URL encoding without padding. Since this is the format required by widely-used ACME clients like Traefik (via the lego library), Infisical should provide the EAB Secret in this format by default, or clearly document any required conversion step.
EAB Secret should survive environment variable passing. When passed through Docker Compose environment variables (e.g., INFISICAL_EAB_SECRET), the secret should remain intact and unmodified. Docker Compose’s $ interpolation should not corrupt the value. Infisical should document how to escape special characters if needed.