diff --git a/acme/challenge.go b/acme/challenge.go
index a68b4151..72a6dc46 100644
--- a/acme/challenge.go
+++ b/acme/challenge.go
@@ -421,7 +421,7 @@ func deviceAttest01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose
 			subproblem := NewSubproblemWithIdentifier(
 				ErrorRejectedIdentifierType,
 				Identifier{Type: "permanent-identifier", Value: ch.Value},
-				"challenge identifier %q doesn't match any of the attested hardware identifiers %s", ch.Value, []string{data.UDID, data.SerialNumber},
+				"challenge identifier %q doesn't match any of the attested hardware identifiers %q", ch.Value, []string{data.UDID, data.SerialNumber},
 			)
 			return storeError(ctx, db, ch, true, NewError(ErrorBadAttestationStatementType, "permanent identifier does not match").WithAdditionalErrorDetail().AddSubproblems(subproblem))
 		}
@@ -479,7 +479,7 @@ func deviceAttest01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose
 			subproblem := NewSubproblemWithIdentifier(
 				ErrorRejectedIdentifierType,
 				Identifier{Type: "permanent-identifier", Value: ch.Value},
-				"challenge identifier %q doesn't match any of the attested hardware identifiers %s", ch.Value, data.PermanentIdentifiers,
+				"challenge identifier %q doesn't match any of the attested hardware identifiers %q", ch.Value, data.PermanentIdentifiers,
 			)
 			return storeError(ctx, db, ch, true, NewError(ErrorBadAttestationStatementType, "permanent identifier does not match").WithAdditionalErrorDetail().AddSubproblems(subproblem))
 		}
diff --git a/acme/challenge_test.go b/acme/challenge_test.go
index 0853943e..aa879726 100644
--- a/acme/challenge_test.go
+++ b/acme/challenge_test.go
@@ -3628,7 +3628,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
 							subproblem := NewSubproblemWithIdentifier(
 								ErrorRejectedIdentifierType,
 								Identifier{Type: "permanent-identifier", Value: "non-matching-value"},
-								`challenge identifier "non-matching-value" doesn't match any of the attested hardware identifiers [udid serial-number]`,
+								`challenge identifier "non-matching-value" doesn't match any of the attested hardware identifiers ["udid" "serial-number"]`,
 							)
 							err := NewError(ErrorBadAttestationStatementType, "permanent identifier does not match").WithAdditionalErrorDetail().AddSubproblems(subproblem)
 
diff --git a/acme/challenge_tpmsimulator_test.go b/acme/challenge_tpmsimulator_test.go
index 96381b80..36876638 100644
--- a/acme/challenge_tpmsimulator_test.go
+++ b/acme/challenge_tpmsimulator_test.go
@@ -287,7 +287,7 @@ func Test_deviceAttest01ValidateWithTPMSimulator(t *testing.T) {
 								AddSubproblems(NewSubproblemWithIdentifier(
 									ErrorRejectedIdentifierType,
 									Identifier{Type: "permanent-identifier", Value: "device.id.99999999"},
-									`challenge identifier "device.id.99999999" doesn't match any of the attested hardware identifiers [device.id.12345678]`,
+									`challenge identifier "device.id.99999999" doesn't match any of the attested hardware identifiers ["device.id.12345678"]`,
 								))
 
 							assert.EqualError(t, updch.Error.Err, err.Err.Error())