A mail server needs a publicly trusted certificate for the hostname clients connect to, and it usually needs it in two or three places at once: Postfix for SMTP, Dovecot for IMAP and POP3, sometimes Exim instead of Postfix. This guide issues one certificate with acme.sh from a commercial certificate authority using External Account Binding, […]
TrueNAS has an ACME client built in, but it cannot authenticate to a certificate authority that requires External Account Binding, and that is what commercial CAs require. So the practical route is to issue the certificate with acme.sh on a machine you already run, then push it into TrueNAS over the API on every renewal. […]
DSM has its own Let’s Encrypt integration, but it cannot authenticate to a certificate authority that requires External Account Binding, which is what commercial CAs use. So the working route is to issue the certificate with acme.sh on a machine you already run, and let acme.sh’s synology_dsm deploy hook push it into DSM at every […]
pfSense issues and renews its own TLS certificates through the ACME package, a graphical front end to the acme.sh client that Netgate maintains. It handles commercial certificate authorities properly, including External Account Binding, so there is no need for an external machine in the normal case. What trips people up is that a commercial CA […]
FortiGate can request and renew its own TLS certificate over ACME, the protocol defined in RFC 8555. This guide covers the case most firewall administrators actually face: issuing that certificate from a commercial certificate authority rather than a free one, which means the FortiGate has to authenticate to the CA with External Account Binding credentials, […]
ACME failures are usually terse, and the useful part is buried in a URN that looks like noise. This guide explains what each of the common errors actually means, where in the process it happens, and what to change. The errors are grouped by which leg of the exchange broke, because that is what decides […]
Plesk can issue and renew certificates from a commercial certificate authority over ACME without any scripting, using its own ACME SSL extension. That extension supports External Account Binding, which is the part commercial CAs require and the reason people assume the panel cannot do it. This guide covers that route first, then the manual acme.sh […]
LiteSpeed has no ACME client of its own, so certificates come from acme.sh, which issues them and then runs a reload command so the running server picks them up. This guide covers both editions, OpenLiteSpeed and LiteSpeed Enterprise, using a commercial certificate authority, which means registering the ACME account with External Account Binding credentials.
Remote Desktop presents a self-signed certificate out of the box, which is why users get a warning every time they connect. You can replace it with a publicly trusted certificate and keep it renewed automatically using win-acme, including certificates from a commercial certificate authority that requires External Account Binding. The part that needs care is […]
Kubernetes handles certificates differently from every other platform in this series. There is no ACME client you run and no file you copy: cert-manager is a controller that watches for certificate resources, talks to the CA, stores the result in a Kubernetes secret and renews it on its own. This guide sets that up against […]
