Https ACME

[Arthur777]

Hello, I'm trying to switch to HTTPS using ACME in my Proxmox cluster, but I'm encountering some difficulties.

I went to my PVE1 -> Certificate -> Add ACME Account.

Then, I went to Add -> HTTP and entered the domain pve1.example.com.

Does anyone have any idea why?

Thanks in advance.

 

[cheiss]

Hi,

is the server publicly reachable? The default HTTP challenge of Let's Encrypt requires that.
If not, have you set up an appropriate DNS challenge plugin?

Please also see our extensive documentation on ACME Plugins, that should hopefully explain everything in detail.

 

[Arthur777]

Yes, I've seen that this could be the problem. The issue is that I have no idea what they mean by API identifier... I don't know what my API is or its identifiers. Its just a local home lab

 

[cheiss]

So to order and receive a TLS certificate, Let's Encrypt must verify that you own the specified domain - through the so-called challenge.
It can either do that via HTTP (meaning the server must be publicly reachable) or via DNS. For the latter you need a DNS provider with a supported API (which is basically most of them).

So, you must have the DNS entries of your domain somewhere hosted. Based the WHOIS record, it seems to be GoDaddy/EasyDNS?

(Of course you can also go the route of running your internal CA, but that's a different story.)

 

[Arthur777]

I have tried this, but it doesn't seem to work.


curl https://get.acme.sh | sh -s email=youremail


acme.sh --issue --syslog 6 -d pve1.example.com --dns dns_acmedns --preferred-chain "ISRG Root X2" --keylength ec-256 --server letsencrypt



I have this issues with the seconde command :

[Mon Apr 8 11:53:56 AM CEST 2024] Using CA: https://acme-v02.api.letsencrypt.org/directory

[Mon Apr 8 11:53:56 AM CEST 2024] Create account key ok.

[Mon Apr 8 11:53:57 AM CEST 2024] Registering account: https://acme-v02.api.letsencrypt.org/directory

[Mon Apr 8 11:53:58 AM CEST 2024] Registered

[Mon Apr 8 11:53:58 AM CEST 2024] ACCOUNT_THUMBPRINT='XkDCyuvb3BK96MTFi1db8RkAaEV5awphDZy6huDjIUA'

[Mon Apr 8 11:53:58 AM CEST 2024] Creating domain key

[Mon Apr 8 11:53:58 AM CEST 2024] The domain key is here: /root/.acme.sh/pve1.example.com_ecc/pve1.example.com.key

[Mon Apr 8 11:53:58 AM CEST 2024] Single domain='pve1.example.com'

[Mon Apr 8 11:53:58 AM CEST 2024] Create new order error. Le_OrderFinalize not found. {

"type": "urn:ietfarams:acme:error:rejectedIdentifier",

"detail": "Error creating new order :: Cannot issue for \"pve1.example.com\": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy",

"status": 400