FreeIPA ACME + Proxmox

The native Proxmox ACME client is unreliable with custom CAs. I previously experienced failures integrating it with Active Directory Certificate Services (AD CS) ACME, and I am currently encountering multiple issues when requesting certificates from a FreeIPA CA.

A solid workaround is to use the acme.sh client. Let’s proceed with that.

Download acme.sh

wget https://raw.githubusercontent.com/acmesh-official/acme.sh/refs/heads/master/acme.sh
chmod +x acme.sh

Requesting certificate

acme.sh --issue \
  --server {ACME_SERVER}  \
  -d {DNS_name} \
  --standalone \
  --keylength 2048 \
  --force

Installing certificate

acme.sh --install-cert \
  -d {DNS_name}} \
  --cert-file /etc/pve/local/pveproxy-ssl.pem \
  --key-file /etc/pve/local/pveproxy-ssl.key \
  --fullchain-file /etc/pve/local/pveproxy-ssl.pem \
  --reloadcmd "systemctl restart pveproxy"