From a3e289954cf596fe734f8da71fc8b8eaab55e86e Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Thu, 6 Nov 2025 23:06:50 -0800
Subject: [PATCH] More test cases

---
 .../bdd/features/pki/acme/access-control.feature   | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/backend/bdd/features/pki/acme/access-control.feature b/backend/bdd/features/pki/acme/access-control.feature
index 3bbc458db..8bb8a1ea3 100644
--- a/backend/bdd/features/pki/acme/access-control.feature
+++ b/backend/bdd/features/pki/acme/access-control.feature
@@ -156,6 +156,20 @@ Feature: Access Control
     Then I create a RSA private key pair as cert_key
     Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
     Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    Then I peak and memorize the next nonce as nonce
+    Then I memorize <src_var> with jq "<jq>" as <dest_var>
+    When I send a raw ACME request to "<url>"
+      """
+      {
+        "protected": {
+          "alg": "RS256",
+          "nonce": "{nonce}",
+          "url": "<url>",
+          "kid": "{acme_account0.uri}"
+        },
+        "payload": {"invalid": "payload"}
+      }
+      """
     # With original owner account under their profile, the invalid payload is going to trigger other errors instead of
     # 404, this is to make sure that our URLs are actually correct
     Then the value response.status_code should not be equal to 404