Added ability to create certs with hmac.

[jdabney]

I added some code to allow you to create certificates with ACME External Account Binding. I added an hmac_key and kid properties and then you can change the "dir" to point to your service and get certs back.

[thoutenbos]

Thanks for this — EAB support is a good addition, and the libraries/acme.rb change (passing external_account_binding into new_account) looks correct, since that's the right place for it per RFC 8555 §7.3.4 (EAB authenticates account creation).

1. Question: is challenge validation intentionally skipped when hmac_key/kid are set?

if !new_resource.hmac_key.nil? && !new_resource.kid.nil?
  # Use the HMAC key and KID to validate the challenges
elsif new_resource.install_authz_block.nil?
  ...

As far as I can tell, EAB only authenticates the account — it doesn't affect domain control validation, which is a separate per-order step (RFC 8555 §7.5) required for every order regardless of how the account was created. This branch is currently just a comment, so no http-01 (or DNS) challenge is ever installed/validated here, and all_validations stays empty. Is there something CA-specific about the provider you're targeting where authorizations don't need a challenge when EAB is used? If not, I'd expect order.finalize to fail later since the authorizations never reach valid.

2. The existing validation-failure check now only runs in the EAB case

if !new_resource.hmac_key.nil? && !new_resource.kid.nil?
  unless (all_validations.map { |authz| authz.status == 'valid' }).all?
    ...
    raise "..."
  end
end

This used to run unconditionally. Now, for users without hmac_key/kid (i.e. everyone currently using this cookbook), a failed authorization no longer raises the cookbook's clear error here — it falls through to acme_cert and surfaces as a raw error deeper in the finalize call instead. Could you check that please?