-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
deployhooks
Before you can deploy your cert, you must issue the cert first.
Here are the scripts to deploy the certs/key to the server/services.
If you want to deploy using cpanel UAPI see 7.
(cpanel deploy hook is not finished yet, this is just an example.)
Then you can deploy now:
export DEPLOY_CPANEL_USER=myusername
export DEPLOY_CPANEL_PASSWORD=PASSWORD
acme.sh --deploy -d example.com --deploy-hook cpanelBefore you can deploy your cert, you must issue the cert first. Currently supports Kong-v0.10.x.
acme.sh --deploy -d ftp.example.com --deploy-hook kongIt deploys to "http://localhost:8001" by default, you can specify the kong url to deploy:
export KONG_URL="http://you.kong.url:port"
acme.sh --deploy -d ftp.example.com --deploy-hook kong
The ssh deploy plugin allows you to deploy certificates to a remote host using SSH command to connect to the remote server. The ssh plugin is invoked with the following command...
acme.sh --deploy -d example.com --deploy-hook sshPrior to running this for the first time you must tell the plugin where and how to deploy the certificates. This is done by exporting the following environment variables. This is not required for subsequent runs as the values are stored by acme.sh in the domain configuration files.
Required...
export DEPLOY_SSH_USER=username
Optional...
export DEPLOY_SSH_CMD=custom ssh command
export DEPLOY_SSH_SERVER=url or ip address of remote host
export DEPLOY_SSH_KEYFILE=filename for private key
export DEPLOY_SSH_CERTFILE=filename for certificate file
export DEPLOY_SSH_CAFILE=filename for intermediate CA file
export DEPLOY_SSH_FULLCHAIN=filename for fullchain file
export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host
export DEPLOY_SSH_BACKUP=yes or no
Added in Acme release 2.8.6...
export DEPLOY_SSH_BACKUP_PATH=path on remote server to backup certificates
export DEPLOY_SSH_MULTI_CALL=yes or no
DEPLOY_SSH_USER Username at the remote host that SSH will login with. Note that SSH must be able to login to remote host without a password... SSH Keys must have been exchanged with the remote host. Validate and test that you can login to USER@URL from the host running acme.sh before using this script.
The USER@URL at the remote server must also have has permissions to write to the target location of the certificate files and to execute any commands (e.g. to stop/start services).
DEPLOY_SSH_CMD
You can customize the ssh command used to connect to the remote host. For example
if you need to connect to a specific port at the remote server you can set this
to, for example, "ssh -p 22" or to use sshpass to provide password inline
instead of exchanging ssh keys (this is not recommended, using keys is
more secure). Defaults to "ssh -T"
DEPLOY_SSH_SERVER URL or IP Address of the remote server. If not provided then the domain name provided on the acme.sh --deploy command line is used. New in Acme release 2.8.7 this may be space separated list of servers to which exactly the same deploy commands can be sent.
DEPLOY_SSH_KEYFILE Target path and filename on the remote server for the private key issued by LetsEncrypt.
DEPLOY_SSH_CERTFILE Target path and filename on the remote server for the certificate issued by LetsEncrypt. If this is the same as the previous filename (for keyfile) then it is appended to the same file.
DEPLOY_SSH_CAFILE Target path and filename on the remote server for the CA intermediate certificate issued by LetsEncrypt. If this is the same as a previous filename (for keyfile or certfile) then it is appended to the same file.
DEPLOY_SSH_FULLCHAIN Target path and filename on the remote server for the fullchain certificate issued by LetsEncrypt. If this is the same as a previous filename (for keyfile, certfile or cafile) then it is appended to the same file.
DEPLOY_SSH_REMOTE_CMD Command to execute on the remote server after copying any certificates. This could be any additional command required for example to stop and restart the service.
DEPLOY_SSH_BACKUP Before writing a certificate file to the remote server the existing certificate will be copied to a backup directory on the remote server. By default these are placed in a hidden directory in the home directory of the SSH user
~/.acme_ssh_deploy/[domain name]-backup-[timestamp]Any backups older than 180 days will be deleted when new certificates are deployed. This defaults to "yes" set to "no" to disable backup.
DEPLOY_SSH_BACKUP_PATH Path to directory on the remote server into which to backup certificates if DEPLOY_SSH_BACKUP is set to yes. Defaults to ".acme_ssh_deploy" which is a hidden directory in the home directory of the SSH user.
DEPLOY_SSH_MULTI_CALL By default this plugin collects up all the required commands to be executed on the remote server and sends them to the remote server in a single SSH call. This fails on some target servers if the command line buffer is not long enough to hold all the data sent in SSH. This is known to affect servers using busybox. By setting this value to "yes" the certificate deployment process is split into multiple SSH calls to work around this problem.
The following example illustrates deploying certificates to a QNAP NAS (tested with QTS version 4.2.3)
export DEPLOY_SSH_USER="admin"
export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
acme.sh --deploy -d qnap.example.com --deploy-hook sshNote how in this example both the private key and certificate point to the same file. This will result in the certificate being appended to the same file as the private key... a common requirement of several services.
The next example illustrates deploying certificates to regular linux server with certbot and nginx installed
export DEPLOY_SSH_USER="root"
export DEPLOY_SSH_SERVER="example.com"
export DEPLOY_SSH_KEYFILE="/etc/letsencrypt/archive/example.com/privkey2.pem"
export DEPLOY_SSH_FULLCHAIN="/etc/letsencrypt/archive/example.com/fullchain2.pem"
export DEPLOY_SSH_CAFILE="/etc/letsencrypt/archive/example.com/cert2.pem"
export DEPLOY_SSH_REMOTE_CMD="systemctl restart nginx"
acme.sh --deploy -d example.com --deploy-hook sshThe next example illustrates deploying certificates to a Unifi Controller (tested with version 5.12.72).
export DEPLOY_SSH_USER="root"
export DEPLOY_SSH_SERVER="unifi.example.com"
export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key"
export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer"
export DEPLOY_SSH_REMOTE_CMD="DIR=/var/lib/unifi && FQDN=unifi.example.com \
&& openssl pkcs12 -export \
-inkey $DIR/$FQDN.key -in $DIR/$FQDN.cer -out $DIR/$FQDN.p12 \
-name unifi -password pass:aircontrolenterprise \
&& keytool -delete -alias unifi -keystore $DIR/keystore \
-deststorepass aircontrolenterprise \
&& keytool -importkeystore -deststorepass aircontrolenterprise \
-destkeypass aircontrolenterprise \
-destkeystore $DIR/keystore -srckeystore /$DIR/$FQDN.p12 \
-srcstoretype PKCS12 -srcstorepass aircontrolenterprise -alias unifi -noprompt \
&& chown -R unifi:unifi $DIR/keystore
&& service unifi restart"
export DEPLOY_SSH_MULTI_CALL="yes"
acme.sh --deploy -d unifi.example.com --deploy-hook sshIn this example we execute several commands on the remote host after the certificate files have been copied... to generate a pkcs12 file compatible with Unifi, to import it into the Unifi keystore and then finally to restart the service.
Note also that once the certificate is imported into the keystore the individual certificate files are no longer required. We could if we desired delete those files immediately. If we do that then we should disable backup at the remote host (as there are no files to backup -- they were erased during deployment). For example...
export DEPLOY_SSH_BACKUP=no
# modify the end of the remote command...
&& rm /var/lib/unifi/unifi.example.com.key \
/var/lib/unifi/unifi.example.com.cer \
/var/lib/unifi/unifi.example.com.p12 \
&& service unifi restartThe next example illustrates deploying certificates to VMware ESXi (tested with version 6.7u3). Requires Acme 2.8.6 or later.
Note that by default ESXi hosts have ssh access disabled and VMware recommends only enabling it if necessary for administrative purposes - displaying a warning notice on the ESXi web interface. You must enable ssh on ESXi and have exchanged ssh keys for this deploy hook to work.
export DEPLOY_SSH_USER="root"
export DEPLOY_SSH_SERVER="vmwareesxi.example.com"
export DEPLOY_SSH_KEYFILE="/etc/vmware/ssl/rui.key"
export DEPLOY_SSH_FULLCHAIN="/etc/vmware/ssl/rui.crt"
export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/hostd restart"
export DEPLOY_SSH_MULTI_CALL="yes"
acme.sh --deploy -d vmwareesxi.example.com --deploy-hook sshacme.sh --deploy -d ftp.example.com --deploy-hook vsftpdThe default vsftpd conf file is /etc/vsftpd.conf, if your vsftpd conf is not in the default location, you can specify one:
export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpdThe default command to restart vsftpd server is service vsftpd restart, if it doesn't work, you can specify one:
export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart"
acme.sh --deploy -d ftp.example.com --deploy-hook vsftpdacme.sh --deploy -d ftp.example.com --deploy-hook exim4The default exim4 conf file is /etc/exim/exim.conf, if your exim4 conf is not in the default location, you can specify one:
export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template"
acme.sh --deploy -d ftp.example.com --deploy-hook exim4The default command to restart exim4 server is service exim4 restart, if it doesn't work, you can specify one:
export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart"
acme.sh --deploy -d ftp.example.com --deploy-hook exim4acme.sh --deploy -d ftp.example.com --deploy-hook keychainThis hook is using UAPI and works in cPanel & WHM version 56 or newer.
acme.sh --deploy -d example.com --deploy-hook cpanel_uapi
DEPLOY_CPANEL_USER is required only if you run the script as root and it should contain cpanel username.
export DEPLOY_CPANEL_USER=username
acme.sh --deploy -d example.com --deploy-hook cpanel_uapiPlease note, that the cpanel_uapi hook will deploy only the first domain when your certificate will automatically renew. Therefore you should issue a separate certificate for each domain.
You must specify the credentials that have administrative privileges on the FRITZ!Box in order to deploy the certificate, plus the URL of your FRITZ!Box, through the following environment variables:
$ export DEPLOY_FRITZBOX_USERNAME=my_username
$ export DEPLOY_FRITZBOX_PASSWORD=the_password
$ export DEPLOY_FRITZBOX_URL=https://fritzbox.example.comAfter the first deployment, these values will be stored in your $HOME/.acme.sh/account.conf. You may now deploy the certificate like this:
acme.sh --deploy -d fritzbox.example.com --deploy-hook fritzboxacme.sh --deploy -d ftp.example.com --deploy-hook strongswanYou must specify the path where you want the concatenated key and certificate chain written.
export DEPLOY_HAPROXY_PEM_PATH=/etc/haproxyYou may optionally define the command to reload HAProxy. The value shown below will be used as the default if you don't set this environment variable.
export DEPLOY_HAPROXY_RELOAD="/usr/sbin/service haproxy restart"You can then deploy the certificate as follows
acme.sh --deploy -d haproxy.example.com --deploy-hook haproxyThe path for the PEM file will be stored with the domain configuration and will be available when renewing, so that deploy will happen automatically when renewed.
You must define the API key and the informations for the project and Gitlab page you are updating the certificate for.
# The token can be created in your user settings under "Access Tokens"
export GITLAB_TOKEN="xxxxxxxxxxx"
# The project ID is displayed on the home page of the project
export GITLAB_PROJECT_ID=12345678
# The domain must match the one defined for the Gitlab page, without "https://"
export GITLAB_DOMAIN="www.mydomain.com"You can then deploy the certificate as follows
acme.sh --deploy -d www.mydomain.com --deploy-hook gitlabexport VAULT_PREFIX="acme"You can then deploy the certificate as follows
acme.sh --deploy -d www.mydomain.com --deploy-hook vault_cliYour certs will be saved in Vault using this structure:
vault write "${VAULT_PREFIX}/${domain}/cert.pem" value=@"..."
vault write "${VAULT_PREFIX}/${domain}/cert.key" value=@"..."
vault write "${VAULT_PREFIX}/${domain}/chain.pem" value=@"..."
vault write "${VAULT_PREFIX}/${domain}/fullchain.pem" value=@"..."You might be using Fabio load balancer (which can get certs from
Vault). It needs a bit different structure of your certs in Vault. It
gets certs only from keys that were saved in prefix/domain, like this:
vault write <PREFIX>/www.domain.com cert=@cert.pem key=@key.pemIf you want to save certs in Vault this way just set "FABIO" env
variable to anything (ex: "1") before running acme.sh:
export FABIO="1"If you are using v2 of the kv api then set the VAULT_KV_V2 environment variable to
anything (ex: "1") before running acme.sh (do not forget to change VAULT_PREFIX as well)
export VAULT_KV_V2="1"You can also use --deploy-hook vault instead of vault_cli. In that case Vault's HTTP
API will be used allowing you to use Docker image for deployment without Vault binary.
Another ENV variable is needed for vault
export VAULT_ADDR=http://localhost:8200 # no slash at the end使用 acme.sh 部署到七牛之前，需要确保部署的域名已打开 HTTPS 功能，您可以访问融合 CDN - 域名管理 设置。 另外还需要先导出 AK/SK 环境变量，您可以访问密钥管理 获得。
$ export QINIU_AK="foo"
$ export QINIU_SK="bar"完成准备工作之后，您就可以通过下面的命令开始部署 SSL 证书到七牛上：
$ acme.sh --deploy -d example.com --deploy-hook qiniu假如您部署的证书为泛域名证书，您还需要设置 QINIU_CDN_DOMAIN 变量，指定实际需要部署的域名(请注意泛域名前的点)：
$ export QINIU_CDN_DOMAIN=".cdn.example.com"
$ acme.sh --deploy -d example.com --deploy-hook qiniu假如需要部署多个域名, 使用空格将域名分隔开来:
$ export QINIU_CDN_DOMAIN="cdn1.example.com cdn2.example.com"
$ acme.sh --deploy -d example.com --deploy-hook qiniuYou should create AccessKey/SecretKey pair in https://portal.qiniu.com/user/key before deploying your certificate, and please ensure you have enabled HTTPS for your domain name. You can enable it in https://portal.qiniu.com/cdn/domain.
$ export QINIU_AK="foo"
$ export QINIU_SK="bar"then you can deploy certificate by following command:
$ acme.sh --deploy -d example.com --deploy-hook qiniu(Optional), If you are using wildcard certificate,
you may need export QINIU_CDN_DOMAIN to specify which domain
you want to update (please note the leading dot):
$ export QINIU_CDN_DOMAIN=".cdn.example.com"
$ acme.sh --deploy -d example.com --deploy-hook qiniuIf you want to deploy more than one domain, just use space to splite them:
$ export QINIU_CDN_DOMAIN="cdn1.example.com cdn2.example.com"
$ acme.sh --deploy -d example.com --deploy-hook qiniuOnce you have acme.sh installed and certificate issued (see info in DNS API), you can install it by following command:
acme.sh --deploy --deploy-hook mydevil -d example.comThat will remove old certificate and install new one.
You can install your certificates to a local mailcow instance. The
deploy hook will copy the certificates and reload the containers, that use the certificates (postfix-mailcow
dovecot-mailcow and nginx-mailcow).
$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
$ acme.sh --deploy -d example.com --deploy-hook mailcowThe default command to restart is docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow, if you want a
custom restart command, specify it by setting DEPLOY_MAILCOW_RELOAD:
$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
$ export DEPLOY_MAILCOW_RELOAD="docker-compose restart"
$ acme.sh --deploy -d example.com --deploy-hook mailcowDeploy the cert to G-Core CDN service (https://gcorelabs.com/ru/) using the G-Core Labs API (https://docs.gcorelabs.com/cdn/).
Then you can deploy now:
export DEPLOY_GCORE_CDN_USERNAME=myusername
export DEPLOY_GCORE_CDN_PASSWORD=mypassword
acme.sh --deploy -d example.com --deploy-hook gcore_cdnacme.sh --deploy -d ftp.example.com --deploy-hook routerosBefore you can deploy the certificate to router os, you need to add the id_rsa.pub key to the routeros and assign a user to that key.
The user need's to have the following policies enabled: ssh, ftp, read, write, password and sensitive.
There are no need to enable ftp service for the script to work, as they are transmitted over SCP, however ftp is needed to store the files on the router.
Then you need to set the environment variables for the deploy script to work.
export ROUTER_OS_USERNAME=certuser
export ROUTER_OS_HOST=router.example.com
export ROUTER_OS_PORT=22
acme.sh --deploy -d ftp.example.com --deploy-hook routerosThe deploy script will remove previously deployed certificates, and it does this with an assumption on how RouterOS names imported certificates, adding a "cer_0" suffix at the end. This is true for versions 6.32 -> 6.41.3 and 7.1.3, but it is not guaranteed that it will be true for future versions when upgrading.
If the router have other certificates with the same name as the one beeing deployed, then this script will remove those certificates.
At the end of the script, the services that use those certificates could be updated. Currently only the www-ssl service is beeing updated, but more services could be added.
For instance:
export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"returns 0 means success, otherwise error.
To adopt parameters to scp and/or ssh set the optional
ROUTER_OS_SSH_CMD and ROUTER_OS_SCP_CMD variables accordingly,
see ssh(1) and scp(1) for parameters to those commands.
Example:
export ROUTER_OS_SSH_CMD="ssh -i /acme.sh/.ssh/router.example.com -o UserKnownHostsFile=/acme.sh/.ssh/known_hosts"
export ROUTER_OS_SCP_CMD="scp -i /acme.sh/.ssh/router.example.com -o UserKnownHostsFile=/acme.sh/.ssh/known_hosts"If there are any bugs for routeros hook,
please report here: https://github.com/Neilpang/acme.sh/issues/2344
See:
https://github.com/Neilpang/acme.sh/wiki/deploy-to-docker-containers
In PAN-OS 9.1+ create a new admin role with API permissions to import and commit. Create a user that will only be used for the purpose of deploying certs. Assign this user to the role you created.
For prior versions of PAN-OS the admin must have superuser access to upload the private key.
export PANOS_USER="your_cert_user"
export PANOS_PASS="your_password"
export PANOS_HOST="10.0.0.1" // Replace with Firewall/Panorama Host
acme.sh --deploy -d example.com --deploy-hook panos --insecure
Note: after a successful deploy you can remove these environment variables as they will be stored by acme.sh. If the password for the user changes you will need to set the variables again. You can also remove --insecure if you deployed a cert and configured it as management cert.
As pointed out inside the deploy script file itself, only 3 simple steps are required for deploy:
- Set the required environment variables which used for authentication while deploying:
- (Recommend) Use an automatically created temp admin user by executing
export SYNO_USE_TEMP_ADMIN=1. In this way, you won't need to provide any admin credentials, and it will be automatically deleted after the script is executed. It depends on DSM built-in utils, so you won't able to use this way in docker. Notice#1: if the script unexpectedly stopped during runtime (e.g., press "Ctrl+C" while executing), the temp admin user may remain without deletion, you can safely delete it manually (or rerun the script). - (Default) Use your existing admin user by provide its credential (username, password, OTP):
- Execute
export SYNO_Username="adminUser"whereadminUseris any user with sufficient administrative rights, e. g.admin. - Execute
export SYNO_Password="adminPassword"whereadminPasswordis the chosen user's password.
- Execute
- Set optional environment variables, if you won't need to change the defaults, then just skip this step, all optional exports are as the following (shown values are the defaults):
-
export SYNO_Certificate=""- to replace a specific certificate via description export SYNO_Scheme="http"export SYNO_Hostname="localhost"export SYNO_Port="5000"-
export SYNO_Create=1- to allow creating the certificate if it doesn't exist -
export SYNO_Device_Name="CertRenewal"- required for omitting 2FA-OTP -
export SYNO_Device_ID=""- required for omitting 2FA-OTP (only pro users may set)
- Execute the command
acme.sh --deploy --deploy-hook synology_dsm -d example.comto deploy the certificate forexample.comto your DSM.
If you installed
acme.shin DSM rather than docker, and executedexport SYNO_USE_TEMP_ADMIN=1, feel free to skip this section, because we won't need your own credential at all. BTW, if your DSM lost the required built-in tools to create temp admin user, the script will let you know, so you can back here to learn more. We highly recommand you to choose the temp user new way if avaiable, so you won't need to provide any of your own DSM credential, and the script won't need to store relaetd credential (in plaintext) on your disk.
For accessing the DSM successfully, the script will require you to provide your admin user credential (username & password), you can do it by exporting them, and for the future automatic execution, the script will save them in your disk (in plaintext).
In recent DSM versions, Synology requires 2-factor authentication enabled for admin users, and requires the user to input TOTP (Time-based One Time Password) code for each API-based access, so the deprecated (still available for backward compatibility) setup requires SYNO_TOTP_SECRET, it will be provided to oathtool to get the code. However, this method has many flaws:
- requires the user to manually install
oathtoolin DSM, since it's not included in the DSM built-in toolkit. - require the user to provide their TOTP SECRET, it will be provided to the third party CLI tool every time we execute the script, and will be saved (in plaintext) on user's disk.
The new setup method won't require generating TOTP each time - TOTP can be omitted by utilizing so-called parameter "device ID".
In the early version of the deployment script, the users need to get it like a pro - its a cookie value leisurely stored in their browser, usually via devtools, then execute export SYNO_DEVICE_ID="<device_id>".
After a few updates, we simplified the process, so we can now act as the same as we are on web UI while deploying - script will ask you to input the TOTP code for the admin user (defined by SYNO_Username) only once, and then obtain to store the "device ID" info (still in plaintext) to your local configuration file, which can be used upon subsequent deployments.
The default device name is CertRenewal, you can select another name as your own wish by exporting it as SYNO_Device_Name.
When issuing a certificate (e.g., Let's Encrypt) for the first time instead of renewing it, export SYNO_Create=1 must be executed once.
Any subsequent run won't need that variable, hence it's not saved within your configuration file at all.
It's recommended to set SYNO_Scheme to https, SYNO_Port to 5001 and SYNO_Hostname to your actual DSM's domain (e.g., nas.example.com) instead of the defaults. Which increased security by TLS-based connection.
However, using https & localhost requires addition of the --insecure command line argument to successfully deploy the certificate to DSM. Though, enabling HTTP/2 still might give you a curl 16 error warning, although the script succeeded anyways.
SYNO_Certificate is set as empty string by default, so the script will replace "default synology certificate" by your domain certificate, it should be all fine. however if you don't want to do so, you can always change it's value to anything you want to describe the certificate.
The deployed certificate should show up inside Control Panel -> Security -> Certificates, it can be assigned to specific services (or set as the default certificate).
This provider supports OpenStack Barbican secret manager.
Report any issues to https://github.com/acmesh-official/acme.sh/issues/3056
This provider requires the OpenStack Client (python-openstackclient) and Barbican client (python-barbicanclient) be installed and available in your path.
It also requires you use Keystone V3 credentials, which can be either password or application credentials provided as environment variables.
You will most likely want to source your OpenStack RC file to set your environment variables:
. openrc.sh
or manually like:
export OS_AUTH_URL=https://keystone.example.com:5000/
export OS_USERNAME=<username>
export OS_PASSWORD=<password>
export OS_PROJECT_NAME=<project name>
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
To deploy a cert:
acme.sh --deploy -d example.com --deploy-hook openstack
Your OpenStack credentials will be saved to ~/.acme.sh/account.conf.
Report any issues to https://github.com/acmesh-official/acme.sh/issues/3276
For this provider you need a OAuth App. You can create it at https://eu.cleverreach.com/admin/account_rest.php. Make sure that at least the "SSL" scope is checked.
Please ensure that your domain for the cert. is already added to your account.
After this set the following variables:
export DEPLOY_CLEVERREACH_CLIENT_ID="Your CleverReach OAuth Client ID"
export DEPLOY_CLEVERREACH_CLIENT_SECRET="Your CleverReach OAuth Client Secret"To deploy the cert now run:
acme.sh --deploy -d example.com --deploy-hook cleverreachNow the cert is added to all domains that are covered by it.
If you are an agency and want to deploy a certificate to a subaccount of yours you add set following additional variable:
export DEPLOY_CLEVERREACH_SUBCLIENT_ID="Desired subaccount Client ID (not OAuth Client ID)"For the required rights please contact the CleverReach support.
The unifi deploy hook supports self-hosted Unifi Controller, Unifi Cloud Key (Gen1/2/2+), and Unifi Cloud Key running UnifiOS (v2.0.0+, Gen2/2+ only). Full support for Cloud Key devices is available in acme.sh v2.8.9 or later.
These instructions are for running acme.sh locally on the Unifi Controller machine or on a Unifi Cloud Key device. If you run acme.sh on a remote machine, follow the Unifi examples under ssh deploy instead.
Report any issues to https://github.com/acmesh-official/acme.sh/issues/3359
To deploy the cert run:
acme.sh --deploy -d example.com --deploy-hook unifiYou may see a warning about "Overwriting existing alias unifi in destination keystore" or that "the JKS keystore uses a proprietary format." Both can be ignored.
The "service unifi restart" step may take a minute or more as it reloads the Unifi Controller.
On a Unifi Cloud Key, acme.sh installations and configuration seem to survive
firmware upgrades when installed in the default location (/root/.acme.sh).
But the renewal cron job may be lost after some firmware upgrades; use crontab -l
to check, and re-install with acme.sh --install-cronjob if necessary.
The unifi deploy hook automatically detects supported Unifi environments, and should not need additional configuration. However, if you have a non-standard (self hosted) Unifi Controller installation, you may need to set some variables before running the deploy hook the first time, e.g:
export DEPLOY_UNIFI_KEYSTORE="/path/to/custom/java/keystore"See the comments at the top of unifi.sh for a list of settings. (Most users should not need to do this.)
# Required settings
export PEPLINK_Hostname="192.168.0.1"
export PEPLINK_Username="Peplink_Admin_Username"
export PEPLINK_Password="Peplink_Admin_Password"
# Optional settings (and default values)
# export PEPLINK_Certtype="webadmin" # The type of certificate in "Network" -> "Certificate Manager". Possible options are: "chub" (ContentHub), "openvpn" (OpenVPN CA), "portal" (Captive Portal SSL),"webadmin" (Web Admin SSL), "webproxy" (Proxy Root CA), "wwan_ca" (Wi-Fi WAN CA), "wwan_client" (Wi-Fi WAN Client)
# export PEPLINK_Scheme="https" # Can be set to HTTP, defaults to HTTPS
# export PEPLINK_Port="443" # Port of Peplink WebUI, defaults to 443
acme.sh --deploy -d example.com --deploy-hook peplinkWhen using https to connect to the Web UI with an existing self-signed certificate (e.g. the default certificate) we need to add the --insecure option to the deploy command. refer to [https://github.com/acmesh-official/acme.sh/wiki/Options-and-Params].
acme.sh --insecure --deploy -d example.com --deploy-hook peplinkThe certificate should now show up in "Network" -> "Certificate Manager".
The deploy script supports TrueNAS Core 12.0-U3 or higher.
The generally recommended deployment method is to run acme.sh on the TrueNAS server itself via the built-in cron facility, using the DNS API mode to authenticate to LetsEncrypt. Almost all TrueNAS servers are not (and should not be) exposed directly to the Internet, so authenticating to LetsEncrypt via the HTTP-01 challenge type is usually not feasible.
(The locked-down nature of the TrueNAS web interface also makes it difficult. While it is possible to set a non-standard HTTP port for the web interface, you would still need to set up an additional HTTP server daemon (preferably in a jail) and redirect port 80 to your new HTTP daemon. You will also need to add the non-standard port number to the end of the DEPLOY_TRUENAS_HOSTNAME value. Since most DNS providers now have APIs this is a lot of unnecessary custom work that can be avoided by just using the DNS API approach.)
Before doing the deployment, you will need to generate an API Key for the server. In the TrueNAS web interface you can click on the gear wheel in the top right corner, then select API Keys from the menu. Carefully record the API Key since it will only be shown once.
The script uses the following environment variables, which only need to be set during the initial run. (The acme.sh deployment framework will store their values automatically for subsequent runs.)
DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI>" # Required
DEPLOY_TRUENAS_HOSTNAME="localhost" # Optional, defaults to localhost
DEPLOY_TRUENAS_SCHEME="http" # Optional, defaults to http, set alternatively to https
If you run acme.sh on a system other than the TrueNAS server then you will need to set the DEPLOY_TRUENAS_HOSTNAME to the IP or Hostname of the TrueNAS server. If the setting "Web Interface HTTP -> HTTPS-Redirect" in the TrueNAS web interface is checked then DEPLOY_TRUENAS_SCHEME will be set to https by default.
acme.sh --insecure --deploy -d truenas.example.com --deploy-hook truenas
This deploy script is tested on OpenMediaVault 5.x. It supports both local and remote deployment. The way it works is that if a cert with the matching domain name is not found, it will firstly create a dummy cert to get its uuid, and then replace it with your cert.
export DEPLOY_OMV_WEBUI_ADMIN="admin"
export DEPLOY_OMV_HOST="192.168.1.200"
export DEPLOY_OMV_SSH_USER="root"
DEPLOY_OMV_WEBUI_ADMIN This is OMV web gui admin account. Default value is admin. It's required as the user parameter (-u) for the omv-rpc command. DEPLOY_OMV_HOST and DEPLOY_OMV_SSH_USER are optional. They are used for remote deployment through ssh (support public key authentication only). Per design, OMV web gui admin doesn't have ssh permission, so another account is needed for ssh.
acme.sh --deploy -d omv.example.com --deploy-hook openmediavaultThis deploy script is tested on Proxmox Virtual Environment 7.2-4. It deploys a certificate through the Proxmox VE API, it requires an API key with access to the sys.modify permission.
To create an API key with the sys.modify permission either create an API key as root or create a new user with the sys.modify permission and create an API key for that user then, when creating the API key, ensure that the Privilege Separation box is unchecked (to inherit permissions from the user) or assign the sys.modify permission directly to the API token. Make note of the Token ID as that will be used as the value for DEPLOY_PROXMOXVE_API_TOKEN_NAME, and make note of the token key itself as that is required and will be used for DEPLOY_PROXMOXVE_API_TOKEN_KEY, the API token key can only be seen once at initial creation and not viewed again afterwards. When creating a new user make note of the username and realm (the string after the @). The username will be used as the value for DEPLOY_PROXMOXVE_USER and the realm will be used as the value for DEPLOY_PROXMOXVE_USER_REALM.
DEPLOY_PROXMOXVE_SERVER: The hostname of the proxmox ve node. Defaults to the domain of the certificate.
DEPLOY_PROXMOXVE_SERVER_PORT: The port number the management interface is on. Defaults to 8006.
DEPLOY_PROXMOXVE_NODE_NAME: The name of the node we will be connecting to. Defaults to the host portion of the server fqdn.
DEPLOY_PROXMOXVE_USER: The user who owns the API key. Defaults to root.
DEPLOY_PROXMOXVE_USER_REALM: The authentication realm the user authenticates with. Defaults to pam.
DEPLOY_PROXMOXVE_API_TOKEN_NAME: The name of the API token created for the user account. Defaults to acme.
DEPLOY_PROXMOXVE_API_TOKEN_KEY: The API token. Required.
export DEPLOY_PROXMOXVE_USER=<username>
export DEPLOY_PROXMOXVE_USER_REALM=<realm>
export DEPLOY_PROXMOXVE_API_TOKEN_NAME=<token_id>
export DEPLOY_PROXMOXVE_API_TOKEN_KEY=<token_secret>
acme.sh --deploy -d vm1.home.wesitcllc.com --deploy-hook proxmoxveBuy me a beer, Donate to acme.sh if it saves your time. Your donation makes acme.sh better: https://donate.acme.sh/
如果 acme.sh 帮你节省了时间,请考虑赏我一杯啤酒🍺, 捐助: https://donate.acme.sh/ 你的支持将会使得 acme.sh 越来越好. 感谢