Using acme.sh on the proxmox host (with Dynu DNS)

acme-proxmox-dynu.md

Proxmox + acme.sh

Using acme.sh on the proxmox host to generate Letsencrypt certificates

With this we show how to use acme.sh instead of the original Letsencrypt interface.

Acme.sh is just a Bash script that can run on pretty much any *nix environment.
It is quite simple but also quite powerfull.

In this guide I will use the cheap and good Dynu service to configure a domain.
Using the DNS allows you to completely bypass the need to point the port 80 of the domain to the machine.

As a matter of fact, there is absolutely ZERO NETWORK configuration needed to generate the certificate.
All you need is curl/wget and outbound internet connection.

The magic happens at the DNS side and you receive the certificate ready to use.

There are many other DNS providers supported (Goddady, etc).

This may also solve the Armageddon Warnings the Browsers show for self-signed certificates.
Just need to make sure the certificate domain name points to the correct IP on the local network (could add to router DNS).

---

DNS Requirements

If you want to use your DNS provider, you will need it to have your domain registered with them, obviouosly.
You may also need to add the subdomain to their DNS records. On Dynu I just add it as a Dynamic DNS entry.

Your DNs provider should also be supported by acme.sh, or you will need to create a DNS file for your system's API.
There are a lot of supported providers though, should not happen easily.

Run Requirements

ssh into proxmox host (change IP address)

ssh [email protected]

We will use git, install it

apt-get update
apt-get install git

Install acme.sh

lets create a work folder

cd /root
mkdir workfolder
cd workfolder

download acme.sh with git

git clone 'https://github.com/Neilpang/acme.sh.git'
cd acme.sh

Install with account (change email address)

./acme.sh --install --accountemail "[email protected]"

If all went fine it was installed to /root/.acme.sh and it has also set a crontab job.
List crontab to check

# crontab -l
24 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

At this point acme.sh is fully operational and can be used in any mode of operation.

Dynu config

Go to the acme.sh installation folder

cd /root/.acme.sh

Edit the account.conf file and add your Dynu credentials

nano account.conf
# vi account.conf    # use vi if your prefer

You need to have an API subscription with Dynu and then generate a ClentId / Secret.
The account.conf will look something like this:

ACCOUNT_EMAIL='[email protected]'
Dynu_ClientId='82637c92-9de7-92fb-2314-2fd378645092'
Dynu_Secret='dfkj328GBs1DSf09ma0sdf9GSD023ds'

If all info is correct, you can then use the Dynu API with acme.sh to generate the certificates.

Generate certificate through Dynu

We will use the default acme.sh folder to generate and then a second call to install the certs.

• This will have a 120s wait for the DNS to change and apply
• One of the good benefits of Dynu is that they hav 90s/120s TTL

To issue a certificate through Dynu you can use

./acme.sh --debug --issue --dns dns_dynu -d my.sub.domain.net

If you want to test using the stage server first, just add --test

./acme.sh --debug --issue --dns dns_dynu -d my.sub.domain.net --test

But then you will need to use --force to ovewrite the test cert

./acme.sh --debug --issue --dns dns_dynu -d my.sub.domain.net --force

Install generated certificates

If all went fine and you have valid certificates, you can install them on the PVE interface.
Please change the subdomain

./acme.sh --debug --installcert -d my.sub.domain.net \
--keypath /etc/pve/local/pveproxy-ssl.key \
--fullchainpath /etc/pve/local/pveproxy-ssl.pem \
--reloadcmd "systemctl restart pveproxy"

In Single-line

./acme.sh --debug --installcert -d my.sub.domain.net --keypath /etc/pve/local/pveproxy-ssl.key --fullchainpath /etc/pve/local/pveproxy-ssl.pem --reloadcmd "systemctl restart pveproxy"

Local DNS config

You may need to tell your router/gateway to point the domain the to LOCAL IP instead of the internet IP so you can use the domain to access proxmox locally.

Or else you can edit you /etc/hosts or C:\Windows\system32\etc\hosts file for a local config.

A host config would look like: IP <space> domain

10.0.1.210 pve-node2.mydomain.net

This is great.
If you use proxmox WebGUI to add ACME DNS Plugin challenge. What and in what format would you use in the API Data field (see pic)?

in the api data field, you just put the env vars you need for your api. for dynu:

Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"

it will be base64 encoded in
/etc/pve/priv/acme/plugins.cfg :

dns: test-fake
	api dynu
	data RHludV9DbGllbnRJZD0ieHh4eHh4eHgteHh4eC14eHh4LXh4eHgteHh4eHh4eHh4eHh4IgpEeW51X1NlY3JldD0ieXl5eXl5eXl5eXl5eXl5eXl5eXl5eXl5eSI=

Never used the WebGUI for this. Seems simple enough with @adcurtin 's answer.

Exact format should be without quotes -

Dynu_ClientId=1234567890abc
Dynu_Secret= 1234567890abc
Dynu_Token= 1234567890abc
Dynu_EndPoint=https://api.dynu.com/v2

Today I used the web interface for the first time to do this.

Here is how I did it:

0. Install Acme account (optional?)

Datacenter > ACME > Accounts > Add
Choose a name and an e-mail.

1. Install your ACME DNS Plugin

Datacenter > ACME > Challenge Plugins > Add

• Plugin ID: dynu
• DNS API: dynu
• API Data: (remove quotes)

Dynu_ClientId=82637c92-9de7-92fb-2314-2fd378645092
Dynu_Secret=dfkj328GBs1DSf09ma0sdf9GSD023ds

You can adjust to your liking or another DNS provider.

2. Add entries to Dynu

• Add alias or subdomain pointing to you desired subdomain (pve-mynode.mydomain.tld)
  

• Add CAA DNS Record
  This authorizes letsencrypt to create certificates do this subdomain
  

3. Create certificate

YourNode > System > Certificates > ACME > Add

• Challenge Type: DNS
• Plugin: dynu
• Domain: pve-mynode.mydomain.tld (same as node hostname)

After creating it, select it and click Order Certificates Now to generate and install the certificates.

Everything went smoothly and proxmox installed and reloaded the main interface with the certificates installed.

Now just need to point the domain to the IP internally (or edit your local hosts file).

With Namecheap DNS provider the default validation delay of 30s was not enough. I extended it to 60 and then the TXT record was validated successfully.

Not sure it should take that long, but glad you figured it out.
Did you use the original CLI method or the Proxmox interface?

Did you use the original CLI method or the Proxmox interface?

I used the GUI that is shown in the comment above. Validation Delay is the value to override.