AcmeClientSpi#obtainCertificate currently determines the order URL that should be used by taking the Location header from the response to finalizing the order (the ACME protocol specification has an example response that includes this header). This works when obtaining certificates from Let's Encrypt and Boulder. However, it seems that EJBCA does not include the Location header in the response to finalizing the order. AcmeClientSpi#obtainCertificate should instead use the Location header from the response to newOrder.