More test cases

backend/bdd/features/pki/acme/access-control.feature

@@ -156,6 +156,20 @@ Feature: Access Control
     Then I create a RSA private key pair as cert_key
     Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
     Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    Then I peak and memorize the next nonce as nonce
+    Then I memorize <src_var> with jq "<jq>" as <dest_var>
+    When I send a raw ACME request to "<url>"
+      """
+      {
+        "protected": {
+          "alg": "RS256",
+          "nonce": "{nonce}",
+          "url": "<url>",
+          "kid": "{acme_account0.uri}"
+        },
+        "payload": {"invalid": "payload"}
+      }
+      """
     # With original owner account under their profile, the invalid payload is going to trigger other errors instead of
     # 404, this is to make sure that our URLs are actually correct
     Then the value response.status_code should not be equal to 404