Setting up ACME for my server

Help
1

Hello everyone,

I am setting up my linux server (alma linux) to get certs from internal ACME server, I tried all the available resources on internet and the chatgpt but nothing helped.
I tried using certbot, nginx and all that can be found on internet.
Could anyone help me witjh necessary steps for getting this done?

2

If you want to issue internal certificates for multiple machines then you could run your own internal CA using smallstep step-ca (with ACME enabled) `step-ca` server or Hashicorp Vault Vault | HashiCorp Developer

If you just want a self signed cert for a single machine them mkcert is useful GitHub - FiloSottile/mkcert: A simple zero-config tool to make locally trusted development certificates with any names you'd like.

If you need publicly trusted certificates for internal machines without running an internal CA you can use certbot (or other ACME clients) with Let's Encrypt but you need to use DNS validation with your own domain and public DNS (your services don't have to be public, you just have to be able to create a corresponding _acme-challenge.service.internal.yourdomain.com TXT record corresponding to the service host name you need.

3 Likes
3

Hey,

I already have a internal CA setup, and I can get the certs manually from the CA, but I want to automate the process and test ACME on my test machine to get certificate from our internal CA, and we do have the internal acme server already working and issuing certs.
But I am not able to get the certs installed on my test machine using acme.

4

The general process for using ACME is:

  • install a client, certbot is a popular one but there are many others
  • use your client to create an ACME account (which is really just a registration of an account key) against the CA, this process varies by acme client, and first involves telling the client the directory URL of your ACME service, for example certbot with step-ca: Configure popular ACME clients to use a private CA with the ACME protocol
  • Once the client has created an account against the CA you can request certificates, again how that's done varies by the ACME client you are using.

Which ACME CA software are you running?

1 Like
5

Certbot

6

Sorry no, which ACME server software are you running for your CA? The software that Certbot will talk to.

1 Like
7

Guess its boulder

8

it's very unlikely: it doesn't have any capacity to manually sign any certificate without ACME veridation. what program you are using to run CA?

2 Likes
9

sorry but that is one of the issues that I don't have a lot of details about the existing acme server

10

Don't think about acme but manual signing

1 Like
11

You only need the directory access point and the rest is described in rfc 8555

12

dogtag

13

okk, thanks will check once that as well

14

maybe you can use this?

3 Likes
15

I'm honestly confused why you're asking this question here. This forum provides support for the Let's Encrypt CA, which you aren't using. It isn't a general support forum for server configuration.

If you don't manage the internal CA infrastructure (and if you didn't even know which software is being used for it, you clearly don't), you should ask whoever does manage it how to accomplish what you need to do. It's likely only a matter of pointing your ACME client to the correct API endpoint, but we have no way of knowing what that is, nor what if any other configuration options would be needed.

5 Likes
16

thanks, this helped, the server was having the port restriction and the http challenge was not picking up the proper location, its corrected now.

17

yes partially true, but the issue got resolved. thanks for the reply anyways

18

thanks

19

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.