Can I get certificates automatically with Let's Encrypt / ACME?

Short answer

Yes. On the Certificates & PKI → SSL/TLS Certificates → Add screen, Type = ACME.SH is selected (the form default); Acme.sh Server (Let's Encrypt, ZeroSSL, SSL.com, Google), Challenge Type (HTTP-01 or DNS-01), the domain names and the automatic renewal threshold are entered. TR7 obtains the certificate the moment the record is added; by checking every day at 07:00 and 22:00, it renews the certificate that reaches the threshold, and the vServices that use the certificate present the new one without any additional action. With HTTP-01, the domain name must reach the vService on TR7 over port 80; a wildcard certificate requires DNS-01 and an ACME DNS Providers profile.

Problem: Renewing Certificates Manually Takes Time and Gets Forgotten

Free certificates issued with ACME have a short lifetime (e.g. 90 days with Let's Encrypt); manual renewal is a frequently repeated task that is prone to being forgotten. The certificate must be obtained automatically and renewed on its own before it expires.

Solution: Three Methods

Methods 1 and 2 differ in the validation method; Method 3 creates the same record from the command line.

Your situation	Suitable method
The domain name reaches the HTTP vService on TR7 from the internet over port 80	Method 1: ACME.SH + HTTP-01
A wildcard certificate or a domain name that is not reachable from the internet over port 80	Method 2: ACME.SH + DNS-01
Creating the record from the command line	Method 3: WEB-CLI

Method 1: ACME.SH + HTTP-01 Recommended

• How it works The ACME server sends the validation request to port 80 of the domain name via the /.well-known/acme-challenge/ path; TR7 answers this request itself over the selected vService, and the request does not go to the Backend Service.
• Where it is openedCertificates & PKI → SSL/TLS Certificates → Add → Type = ACME.SH → Challenge Type = HTTP-01
• Requirement The domain name must resolve in DNS to the vService address; the vService must have a frontend row with the HTTP or HTTP → HTTPS protocol on port 80; if the domain name has a CAA record, it must allow the selected authority
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the add form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → SSL/TLS Certificates screen, Add is clicked (how to add).

2

Adım 2 Select the name and the type

Certificate Name is entered; in the Type field, the default ACME.SH is left. The type cannot be changed after the record is saved.

3

Adım 3 Select the ACME server and the account

In the Acme.sh Server field, the default letsencrypt is left, or zerossl, sslcom or google is selected; the information box below the field shows the value that must be present in the CAA record of the domain name. If zerossl, sslcom or google is selected, the values given by the authority are entered in the EAB ID and EAB HMAC fields that appear. For the expiry notifications of the authority to reach the organization, an address is written in the Acme.sh E-mail Register Address field; if it is left empty, the default account address of TR7 is used.

4

Adım 4 Enter the validation and the domain names

In the Challenge Type field, the default HTTP-01 is left. In each row of the Domain and vService table, a domain name to be included in the certificate and the HTTP vService that publishes this name are written; the vService of the first row comes empty and must be selected. A new row is added with + Add; the certificate covers all the names in the list.

5

Adım 5 Select the key and the renewal

Acme.sh Key Length is ec-256 by default (ec-384, ec-521 or RSA 2048, 3072, 4096 can be selected). Acme.sh Automatic Renewal is 30 days before expiry by default (7, 14, 30, 45, 89, 179 days or Disabled). In a cluster setup, under the Network Source for Request heading at the bottom of the form, the device from which the request will leave (Device, default device number 1) and the Route Table from which it will leave are selected; the obtained certificate is transferred to the other device.

6

Adım 6 Save the certificate record

Add at the bottom of the form is clicked; the certificate obtaining operation starts the moment the record is created. The progress and the result are followed in the ACME.SH tab in the preview of the record.

7

Adım 7 Open the vService edit form

After the certificate is obtained, on the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

8

Adım 8 Select the certificate

In the Certificate field, which appears while there is a frontend row with the Encrypted (HTTPS) protocol, the ACME certificate is selected.

9

Adım 9 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1ObtainingTR7 side

The certificate row is clicked; in the ACME.SH tab of the preview, the result of the last run and the console output are read.

ExpectedSucceeded · Valid Until filled in the list

With the Failed badge, the error in the console output is read; the most common causes are port 80 not being reachable, the domain name resolving to another address, and the CAA record. The Get New Certificate button in the tab restarts the operation manually.

Method 2: ACME.SH + DNS-01

• How it works TR7 writes a temporary _acme-challenge TXT record to the domain name with the API of the selected DNS provider; the ACME server performs the validation over DNS. It is the only way for a wildcard certificate; the vService does not need to be reachable from the internet over port 80.
• Where it is openedCertificates & PKI → ACME DNS Providers · certificate form → Challenge Type = DNS-01
• Requirement API access at the provider that hosts the DNS of the domain name (Cloudflare, Amazon Route 53, Azure DNS or another provider supported by acme.sh)
• vService type HTTP, L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the DNS provider form

On the Certificates & PKI → ACME DNS Providers screen, Add is clicked (how to add).

2

Adım 2 Define the provider

Provider Name is entered; Provider Type is selected and the credentials that appear according to the type are entered (details: Which DNS providers are supported for the ACME DNS challenge?).

3

Adım 3 Save the provider

Add is clicked; the profile is added to the list.

4

Adım 4 Open the certificate add form

On the Certificates & PKI → SSL/TLS Certificates screen, Add is clicked; Certificate Name is entered, Type = ACME.SH is left, and the server and the e-mail are selected as in step 3 of Method 1.

5

Adım 5 Select DNS-01

Challenge Type = DNS-01 is selected; in the DNS Provider field that appears, the profile from step 3 is selected. The names are written in the Domain and vService table; if the domain name itself and its subdomains are to be covered together, two rows are entered (example.com and *.example.com).

6

Adım 6 Select the key and the renewal

Acme.sh Key Length and Acme.sh Automatic Renewal are selected as in step 5 of Method 1.

7

Adım 7 Save

Add is clicked; TR7 writes the TXT record, waits for the validation and obtains the certificate. The certificate is assigned to the vService with steps 7–9 of Method 1.

Verification

1ObtainingTR7 side

The result is seen in the ACME.SH tab of the preview, and the names covered by the certificate in the DNS row of the Details tab.

ExpectedSucceeded · DNS: example.com, *.example.com

Method 3: WEB-CLI

• How it works The ACME record is created from the command line; obtaining starts when the record is added. The 30-day default renewal threshold in the interface is not applied in WEB-CLI: if the threshold is not written, the first value of the list, 7 days, is saved. For this reason, the threshold is written explicitly (7, 14, 30, 45, 90 or 180).
• Where it is opened TR7 WEB-CLI → lb certificate add
• Requirement WEB-CLI access; the network and DNS requirements in Method 1 or 2
• vService type HTTP (HTTP-01); HTTP, L7 TCP (DNS-01)

Step-by-Step Configuration

1

Adım 1 Create the record with HTTP-01

In place of <vService>, the name of the HTTP vService that will answer the validation request is selected with Tab (acmeSh):

lb certificate add type acmeSh name portal-le --acmeShServer letsencrypt --acmeShEmailAddress ops@example.com --acmeShChallengeType http01 --acmeShDomains.0.domain portal.example.com --acmeShDomains.0.poolId <vService> --acmeShRenewThreshold 30

The second domain name is added to the same line with --acmeShDomains.1.domain and --acmeShDomains.1.poolId.

2

Adım 2 Create the wildcard record with DNS-01 (if needed)

When dns01 is written, the provider field becomes required and is written right after it, without --; the wildcard value is given in single quotes:

lb certificate add type acmeSh name joker-le --acmeShChallengeType dns01 acmeShDnsProviderId <provider> --acmeShDomains.0.domain '*.example.com' --acmeShDomains.0.poolId <vService> --acmeShRenewThreshold 30

Verification

1Record and obtainingTR7 side

The record is listed; the result of the obtaining is followed in the interface from the ACME.SH tab of the record.

Command: lb certificate list

Expectedportal-le in the list · Succeeded in the ACME.SH tab

Common Mistakes

• Not defining port 80 on the vService with HTTP-01. The validation request comes to port 80 of the domain name; if the vService listens only on 443, obtaining fails. An HTTP → HTTPS row on port 80 is sufficient.
• Using HTTP-01 with an L7 TCP vService. The validation request is answered only over an HTTP vService; for L7 TCP, DNS-01 is used.
• Selecting HTTP-01 for a wildcard. The form gives the Wildcard domains require the DNS-01 challenge error.
• Overlooking the CAA record. If the domain name has a CAA record, it must allow the selected authority (letsencrypt.org for Let's Encrypt, sectigo.com for ZeroSSL, ssl.com for SSL.com, pki.goog for Google).
• Leaving Acme.sh Automatic Renewal as Disabled. With this option, the certificate is not renewed on its own; the renewal is done manually with Renew Certificate in the ACME.SH tab.
• Staying on the buypass server in old records. Since Buypass has stopped issuing certificates, the records on this server cannot be renewed; the record is edited and another server is selected.

How it is done in the documentation

• SSL/TLS Certificates · ACME.SH
• SSL/TLS Certificates · Challenge Type
• SSL/TLS Certificates · ACME.SH Tab
• ACME DNS Providers · How to Add?

Related questions

• What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?
• Which DNS providers are supported for the ACME DNS challenge?
• When I renew a certificate, do I need to replace it on each vService one by one?