ACME for certbot, acme.sh and Caddy

ACME is the protocol that certbot, acme.sh, lego, Caddy, Traefik and cert-manager use to issue and renew certificates on their own. ZRAZU offers two ways to use it. Both are set up in the cabinet: “SSL certificates” → “ACME for certbot” (cabinet). The owner, administrators and technicians can create entries.

In both cases the private key stays on your server.

The ZRAZU ACME server

This is our certificate server for the paid subscription. Address (Directory): https://api.zrazu.com/acme/directory. The client registers on it through an EAB binding.

1. In the block “Our ACME server for paid certificates” enter a binding name, for example the server name, and click “Create”.
2. Save the Directory, the kid and the HMAC key shown. The key is shown once and nobody can restore it.
3. In the wizard “Setup for your server” choose the program (nginx with certbot, acme.sh, Caddy, Traefik, Kubernetes cert-manager, win-acme for IIS) and the domain. The cabinet shows ready commands.
4. Register the client within 7 days, otherwise the binding expires. For certbot it looks like this:

certbot register --server https://api.zrazu.com/acme/directory \
  --eab-kid <kid> --eab-hmac-key <HMAC key> --agree-tos -m you@example.com

A binding is either personal (valid while you are in the organization and can reissue certificates) or the organization’s (for a server that outlasts team changes; created by the owner and administrators). You can disable a binding in the list: issued certificates stay.

How the ACME server behaves:

• It first looks for a paid active subscription whose names cover the order. A reissue within the subscription costs nothing extra.
• The first issuance of a subscription must be done in the cabinet: there is nothing to reissue yet, and buying twice is not allowed.
• If there is no subscription, certbot can buy a certificate from the balance, but only when you turned on “Buy new certificates from the balance” in the binding and the funds are enough. Never on credit. We write to the owners about every purchase.
• The domain must be on our name servers: we place the validation record in the zone ourselves. Issuance takes up to a few minutes.
• Revocation through ACME is possible only with the keyCompromise reason and a signature by the certificate’s own key. Otherwise revoke in the cabinet (Reissuing and revoking).

We email the owners about every reissue, purchase and revocation.

acme-dns: free certificates through DNS

Suited for Let’s Encrypt through certbot, acme.sh, lego and Caddy with the standard acme-dns plugin. One record covers both the domain and *.domain, so this is the way for wildcard. No key to the whole zone is needed.

1. In the block “New account” enter the domain. If you wish, give allowed IP addresses or networks, separated by commas.
2. Click “Create” and save the password. It is shown once.
3. Add the CNAME _acme-challenge.domain pointing into the ZRAZU zone. If the domain is on our name servers or in your Cloudflare with an edit key, click “Add CNAME” (or “Set the CNAME in Cloudflare”). Otherwise add the record at your DNS provider.
4. Copy the acmedns.json file or the commands for your client from the cabinet and issue the certificate.

The password can only set the TXT validation for its own name. It cannot change the zone, the domain or the balance. An account with no update in 30 days, or with no updates for over a year, is deleted automatically together with our CNAME.

If the domain is behind Cloudflare proxy (the orange cloud), visitors see the Cloudflare certificate, and yours is needed for the site server (Full strict mode).

If it didn't work

• ACME is switched off in this environment. The cabinet shows this note when the feature is temporarily unavailable. Write to support.
• “wait for the first issuance”. The subscription has not been issued yet: do the first issuance in the cabinet.
• Issuance hangs. Check that the domain is on ZRAZU name servers.
• The purchase did not work. Check that purchase is enabled in the binding, the balance has enough funds, and the binding’s creator has the payment permission.
• Binding “expired unused”. The HMAC key is valid for 7 days: create a new binding.
• Wildcard will not work over HTTP. For *. use DNS-01 validation and acme-dns: for acme.sh that is --dns dns_acmedns.
• You lost the acme-dns password. Delete the account and create a new one.