ACME client includes private IP in request

[d1nuc0m]

Hi, I am trying to get a TLS certificate with ACME on PDM.
The machine has a private IPv4 and the certificate request fails because the IP is included in the request (and almost no public CA releases a certificate for a private IP):



Hostname is configured correctly both in hostnamectl and /etc/hosts

Packages:

libproxmox-acme-plugins/stable,now 1.7.1 all [installed]
proxmox-archive-keyring/stable,now 4.0 all [installed]
proxmox-datacenter-manager-client/stable,now 1.1.4 amd64 [installed]
proxmox-datacenter-manager-docs/stable,now 1.1.4 all [installed]
proxmox-datacenter-manager-meta/stable,now 1.1.0 all [installed]
proxmox-datacenter-manager-ui/stable,now 1.1.2 amd64 [installed]
proxmox-datacenter-manager/stable,now 1.1.4 amd64 [installed]
proxmox-default-kernel/stable,now 2.1.0 all [installed]
proxmox-enterprise-support-keyring/stable,now 1.0 all [installed]
proxmox-geojson-data/stable,now 1.1 all [installed]
proxmox-kernel-7.0.2-6-pve-signed/stable,now 7.0.2-6 amd64 [installed]
proxmox-kernel-7.0.6-2-pve-signed/stable,now 7.0.6-2 amd64 [installed,automatic]
proxmox-kernel-7.0/stable,now 7.0.6-2 amd64 [installed,upgradable to: 7.0.12-1]
proxmox-kernel-helper/stable,now 9.2.0 all [installed]
proxmox-mail-forward/stable,now 1.0.3 amd64 [installed]
proxmox-mini-journalreader/stable,now 1.6 amd64 [installed]
proxmox-offline-mirror-docs/stable,now 0.7.4 all [installed]
proxmox-offline-mirror-helper/stable,now 0.7.4 amd64 [installed]
proxmox-termproxy/stable,now 2.1.0 amd64 [installed]

 

[j.theisen]

Hi @d1nuc0m

thanks for posting on the forum!

Can you please share your (sanitized) ACME cert configuration file and in case DNS validation is used the plugins file.

cat /etc/proxmox-datacenter-manager/acme/certificate.cfg
cat /etc/proxmox-datacenter-manager/acme/plugins.cfg

Yours sincerely
Jonas

 

[d1nuc0m]

@j.theisen thanks, using HTTP-01 challenge, so there are no DNS files

cat /etc/proxmox-datacenter-manager/acme/certificate.cfg
acme: account=acme.example.com
acmedomain0: my-pdm.example.com

cat /etc/proxmox-datacenter-manager/acme/plugins.cfg
cat: /etc/proxmox-datacenter-manager/acme/plugins.cfg: No such file or directory

Btw, I am not using Let's Encrypt, but added another CA with

proxmox-datacenter-manager-admin acme account register acme.example.com my-email@example.com --directory https://acme.example.com/directory

 

[j.theisen]

Thanks for the information!

Could you please also provide the Output of the "Order Certificate" task you posted earlier.

Yours
Jonas

 

[d1nuc0m]

@j.theisen here it is

2026-06-24T17:04:03+02:00: Placing ACME order
2026-06-24T17:04:03+02:00: Order URL: https://acme.example.com/order/urn:uuid:18580321-df88-4645-a7c3-b667fd049c6a
2026-06-24T17:04:03+02:00: Getting authorization details from 'https://acme.example.com/authorization/urn:uuid:2f0c6897-207d-4701-9d05-119b75e4d60e'
2026-06-24T17:04:03+02:00: The validation for my-pdm.example.com is pending
2026-06-24T17:04:03+02:00: Setting up validation plugin
2026-06-24T17:04:03+02:00: Triggering validation
2026-06-24T17:04:03+02:00: TASK ERROR: urn:ietf:params:acme:error:rejectedIdentifier: ('rejectedIdentifier', '172.18.X.Y not in allowed ranges')

 

[sterzy]

Hey, thanks for the provided information. This seems a little weird to me. Would you mind providing the account config for this ACME server? It should be located in /etc/proxmox-datacenter-manager/acme/accounts/<acount-name>.

It would also be helpful if you could provide uncensored config files here. Since you don't want to post them publicly, which is understandable, would you mind sending them to me via private message?

Also, if this is a public ACME provider, would you mind sharing which one you are using? Thank you!

 

[d1nuc0m]

@sterzy tried to send it, but got "You may not send a direct message to the following recipients: sterzy."

 

[sterzy]

Ah sorry about that, send you a message now, hope that works.