View source for PKI ACME Responder

= Overview =

This page describes the procedure to install ACME responder being developed for PKI 10.8.

The development branch is available at:

* https://github.com/edewata/pki/commits/acme

= Installation =

* [[Installing Standalone ACME Responder]]
* [[Installing ACME Responder in PKI CA]]
* [[Configuring ACME Responder]]

= Usage =

Note that certbot does not accept self-signed CA certificate,
so the operations below are executed with plain HTTP URLs.

== Certificate Enrollment with HTTP-01 ==

To request a certificate with automatic http-01 validation:

<pre>
$ certbot certonly --standalone \
    --server http://$HOSTNAME:8080/acme/directory \
    -d $HOSTNAME \
    --preferred-challenges http \
    --register-unsafely-without-email
</pre>

To request a certificate with manual http-01 validation:

<pre>
$ certbot certonly --manual \
    --server http://$HOSTNAME:8080/acme/directory \
    -d $HOSTNAME \
    --preferred-challenges http \
    --register-unsafely-without-email
</pre>

Make sure the web server is set up properly:

<pre>
$ curl http://$HOSTNAME/.well-known/acme-challenge/<token>
</pre>

== Certificate Enrollment with DNS-01 ==

To request a certificate with manual dns-01 validation:

<pre>
$ certbot certonly --manual \
    --server http://$HOSTNAME:8080/acme/directory \
    -d server.example.com \
    --preferred-challenges dns \
    --register-unsafely-without-email
</pre>

Make sure the TXT record is created properly:

<pre>
$ dig _acme-challenge.server.example.com TXT
</pre>

The certificate will be stored at /etc/letsencrypt/live/server.example.com/cert.pem.

To inspect the certificate:

<pre>
$ openssl x509 -text -noout -in /etc/letsencrypt/live/server.example.com/cert.pem
</pre>

== Certificate Revocation ==

To revoke with ACME account:

<pre>
$ certbot revoke \
    --server http://$HOSTNAME:8080/acme/directory \
    --cert-path /etc/letsencrypt/live/server.example.com/cert.pem
</pre>

To revoke with private key:

<pre>
$ certbot revoke \
    --server http://$HOSTNAME:8080/acme/directory \
    --cert-path /etc/letsencrypt/live/server.example.com/cert.pem \
    --key-path /etc/letsencrypt/live/server.example.com/privkey.pem
</pre>

See also:

* [https://letsencrypt.org/docs/revoking/ Revoking certificates]

== Creating an Account ==

To create an ACME account:

<pre>
$ certbot register \
    --server http://$HOSTNAME:8080/acme/directory \
    -m admin@example.com \
    --agree-tos
</pre>

== Updating Account ==

To update an ACME account:

<pre>
$ certbot update_account --server http://$HOSTNAME:8080/acme/directory \
    -m admin@example.com
</pre>

== Deactivating an Account ==

To deactivate an ACME account:

<pre>
$ certbot unregister --server http://$HOSTNAME:8080/acme/directory
</pre>

= See Also =

* [[ACME]]
* [[PKI ACME Container]]
* [[PKI ACME OpenShift]]
* [[PKI Server Webapp CLI]]
* [[IPA ACME Responder]]
* [[certbot]]