Repository navigation
2.2.0: certificates from your own CA, Active Directory Certificate Services included - #27
Merged
Merged
Conversation
…te to trust A custom account names any ACME server, such as acme2certifier in front of Active Directory Certificate Services, step-ca or Vault. The CA certificate is added to the system's for that account's acme.sh runs only, and a CA_BUNDLE acme.sh saved into account.conf is taken out before every run, so it never replaces the trust for another CA. The directory is read first, so an untrusted, unreachable or wrong address fails at once with what to fix instead of acme.sh retrying for ten minutes.
Buypass stopped issuing on 31 October 2025 and left acme.sh in 3.1.2, which then took the name for a directory URL; it is refused now, with why. Google's test CA, SSL.com and Actalis are added, and the CAs that need EAB refuse an account without it. Between the renewal rounds, every 10-minute tick renews a certificate whose acme.sh plan has come due, so a CA of your own that issues for a day (step-ca by default) is not missed by a daily round.
…gh the acme2certifier the node runs for them An ACME account can have Active Directory Certificate Services as its CA: the CA's server, name and template, the enrollment method (MS-ICPR or web enrollment), the authentication and a service account. At an issuance the node writes acme2certifier's configuration, starts it on localhost under waitress, points acme.sh at it and stops it again; the configuration, which holds the password, is removed afterwards. Nothing to supervise, no port opened, and several AD CS accounts take turns. Any other acme2certifier setting goes into the account's extra settings, acme_srv.cfg lines laid over the generated ones; the configuration view shows the result with the password masked, and the connection test asks the CA for a connection with the account as typed. The image carries acme2certifier (its GitHub release .deb) and Impacket, without Impacket's example tools; a node installed otherwise fetches it at the first issuance or from the Certificates page. The weekly upstream check follows its releases too.
…, the .rpm layout, the log, the plan by key type Extra acme2certifier settings: a *_module must be one of acme2certifier's own modules; handler_file, hooks_file, eab_handler_file, log_file and a krb5_kinit_path outside the system's are refused. acme2certifier takes a file path there, which made the box a way to run a file as root. The extra settings are redacted for MCP. The on-demand install on .rpm systems fetches both of acme2certifier's packages and finds them under /opt/acme2certifier (tried on Rocky Linux 9); the connection test runs acme2certifier's module rather than a script on the path, does not wait behind an issuance, and reads every WWW-Authenticate header. acme2certifier's output reaches the stored log. The configuration view masks by setting. renewal_due reads acme.sh's plan from the folder of the certificate's current key type. run_script moves to util for both installers.
…t at the first issuance
…tificates that use them - an alias that is not text is refused with a reason, not a 500; a list of names is taken - a pasted _acme-challenge. label and a trailing dot are dropped; an address is not a host name - "no" in a position leaves that domain to its own zone, as acme.sh has it - the alias is checked for DNS-01 only, and the wizard sends it for DNS-01 only - per-domain aliases that do not fit a certificate are refused when the challenge type or the certificate is saved and in the wizard, and before the CA is asked anything - the wizard, reusing a certificate, takes the order the aliases were typed for - the alias tests in one file; a UI test for the editor and the wizard
…he editor and the wizard, not stored, not passed at registration
…nology, Proxmox Backup and Mail Gateway, NetBox, Headscale, Collabora, ONLYOFFICE, Jitsi, Zulip, Sentry, NATS, EMQX and others, each checked against the application's documentation
|
Tested and it works. |
…rvices, DNS alias mode, 36 more recipes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
2.2.0, from the 2.2.0-beta.1, beta.2 and beta.3 pre-releases, with 2.1.1 merged in. Refs #26.
customas its CA names the ACME directory URL and, optionally, a CA certificate to trust for that server's HTTPS (added for that account's runs only; acme.sh's savedCA_BUNDLEis removed before every run so it cannot leak into other CAs). The node reads the directory first, with a 15-second timeout, so an untrusted certificate, an unreachable server or a wrong address fails at once with what to fix instead of acme.sh retrying for ten minutes. Tried with step-ca, Vault's PKI engine and acme2certifier.acme_srv.cfglines) are laid over the generated configuration; Show the configuration and Test the connection to the CA sit in the account editor and the wizard. The image carries acme2certifier and Impacket (its example tools left out); other nodes fetch it at the first issuance or from the Certificates page. The upstream check follows its releases.google_test,sslcomandactalisadded, EAB required for Google, SSL.com and Actalis.Everything up to the CA has been exercised for AD CS; the enrollment itself awaits a real AD CS (#26).
Tests: Python suite passes in the image (test-recipes needs a live node), UI suite 597 checks, 1458 strings in 10 languages, docs check and build pass. Guide: https://ham.iothing.net/docs/certificates/#your-own-certificate-authority