import json, urllib.request, base64, hmac, hashlib, re
from cryptography.hazmat.primitives.serialization import load_pem_private_key
from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
from cryptography.hazmat.primitives.asymmetric.padding import MGF1
from cryptography.hazmat.primitives.hashes import SHA256

def b64url(b): return base64.urlsafe_b64encode(b).rstrip(b'=').decode()

key_pem = open('/root/.acme.sh/ca/acme.zerossl.com/v2/DV90/account.key','rb').read()
caconf = open('/root/.acme.sh/ca/acme.zerossl.com/v2/DV90/ca.conf').read()
kid = re.search(r"CA_EAB_KEY_ID='([^']+)'", caconf).group(1)
hmac_key = re.search(r"CA_EAB_HMAC_KEY='([^']+)'", caconf).group(1)
key = load_pem_private_key(key_pem, password=None)
pub = key.public_key(); nums = pub.public_numbers()
jwk = {"kty":"EC","crv":"P-256","x":b64url(nums.x.to_bytes(32,'big')),"y":b64url(nums.y.to_bytes(32,'big'))}
alg = "ES256"
def sign(msg): return key.sign(msg, ec.ECDSA(SHA256()))

ORDER_URL = "https://acme.zerossl.com/v2/DV90/order/xjUXizbxcyKU_DcU7c_cBA"

# Get nonce from directory (GET returns Replay-Nonce header)
r = urllib.request.urlopen(urllib.request.Request("https://acme.zerossl.com/v2/DV90/directory"), timeout=20)
nonce = r.headers.get("Replay-Nonce")
print("nonce from directory:", nonce)

def post_as_get(url, nonce):
    hdr = {"alg":alg,"jwk":jwk,"nonce":nonce,"url":url}
    h64 = b64url(json.dumps(hdr,separators=(',',':')).encode())
    p64 = b64url(b'')
    si = f"{h64}.{p64}".encode()
    sig = sign(si)
    body = {"protected":h64,"payload":p64,"signature":b64url(sig)}
    req = urllib.request.Request(url, data=json.dumps(body).encode(), headers={"Content-Type":"application/jose+json","User-Agent":"zsquery/1"})
    resp = urllib.request.urlopen(req, timeout=25)
    new_nonce = resp.headers.get("Replay-Nonce")
    return resp.status, json.loads(resp.read().decode()), new_nonce

st, res, nonce = post_as_get(ORDER_URL, nonce)
print("\n=== ORDER STATUS === HTTP", st)
print(json.dumps(res, indent=2)[:2500])