2.2.0-beta.6: certificates from your own CA, Active Directory Certificate Services, DNS alias mode, 36 more recipes

Beta. Only nodes with Also offer beta versions ticked (Settings → Updates) are offered this. Package installs (Proxmox CT, .deb/.rpm) need GH_INCLUDE_PRERELEASE=1 for the CT script; the Updates page picks it up on a node that has asked for betas.

2.2.0-beta.6: certificates from your own CA, Active Directory Certificate Services, DNS alias mode, 36 more recipes

This beta holds everything in 2.2.0-beta.5 and adds 36 recipes and a tidier ACME account editor. It also includes everything in 2.1.1: what MCP shows and logs, uploaded certificates, IPv6 binds, the tunnel timeout, redirects.

New in beta.6: 36 more recipes

Start from a recipe now offers 207 services. Each new one was checked against the application's own documentation or source: the port, the health check, and what the application has to be told when it sits behind a proxy. That last part is in the recipe's notes.

• Windows: Microsoft Exchange (checked with its healthcheck.htm), AD FS (passed through, checked with /adfs/probe on port 80), Remote Desktop Gateway (passed through, each client kept on one gateway), Windows Admin Center, Microsoft SQL Server.
• Infrastructure: Synology DSM, Proxmox Backup Server, Proxmox Mail Gateway, Headscale, Technitium DNS, OpenMediaVault, Minecraft (Java Edition).
• Collaboration: Collabora Online, ONLYOFFICE Docs, Jitsi Meet, Zulip, Zammad, OpenProject.
• Developer and data: code-server, JupyterHub, Metabase, Apache Superset, Sentry, GlitchTip, Semaphore UI, AWX, NetBox, Wazuh dashboard.
• Home automation and game panels: openHAB, ioBroker, Pterodactyl Panel, Pelican Panel.
• Databases and messaging: PgBouncer, Oracle Database, NATS (checked with /healthz on its monitoring port), EMQX (checked with /status on its dashboard port).

New in beta.6: no EAB fields for a CA that has no EAB

Let's Encrypt and its test CA do not use external account binding, yet the account editor and Request a certificate showed EAB key ID and EAB HMAC key for them. The two fields are now shown only for a CA that takes them (ZeroSSL, Google, SSL.com, Actalis, a custom server). Values left over on a Let's Encrypt account are dropped when it is saved and are not passed at registration.

New in beta.5: DNS alias mode

Contributed by GGeorggg (PR #29), with fixes on top.

When the zone a certificate's names are in has no API, or its credentials should not sit on a load balancer, the validation record can be made in another zone. This is acme.sh's DNS alias mode. Point _acme-challenge.<name> at _acme-challenge.<alias zone> with a CNAME, once, and give the DNS-01 challenge type the alias zone's hook and credentials and the alias in the new Challenge alias domain field. The field is in the challenge type editor and in Request a certificate.

• One alias serves every name on every certificate that uses the challenge type.
• One alias per name, separated by spaces, is paired with a certificate's names in order. no in a position leaves that name to its own zone.
• A name pasted with _acme-challenge. in front, or with a trailing dot, is stored as the alias it means.
• A list of aliases that does not fit a certificate's names is refused when the challenge type or the certificate is saved, and in the wizard, rather than failing at the next renewal.

New in beta.4: acme2certifier is installed without asking

On a node installed from a package (.deb, .rpm, the Proxmox container) or with install.sh, beta.3 fetched acme2certifier only at the first certificate request, or from a button that appeared once an AD CS account had been saved. Test the connection to the CA, pressed before that, could only answer acme2certifier is not installed on this node.

• The service installs it when it starts and finds it missing: after an install, after an update, after any restart, whether or not an account uses AD CS yet. It takes about a minute, in the background, and needs the node to reach github.com.
• Test the connection to the CA and a certificate request made during that minute wait for the install instead of failing.
• If the install fails, the node tries twice more over the next quarter of an hour. After that, the Certificates page says what stopped it, with Install acme2certifier now to try again.
• The container image is unchanged: it already carried acme2certifier.

A package cannot do this itself: acme2certifier is in no distribution's repository for the package to depend on, so the service fetches its release from GitHub, and Impacket from your package mirrors.

Your own ACME server

An ACME account can now use custom as its certificate authority: any ACME server, by the URL of its directory. Under Settings › ACME Settings, or while creating the account in Request a certificate:

• ACME directory URL, such as https://ca.example.lan/directory.
• CA certificate to trust (optional): the PEM certificate of the CA that signed the ACME server's own HTTPS certificate. It is added to the system's trusted CAs for that account's runs only.
• EAB key ID and HMAC key, if your server asks for them.

Tried end to end with:

• Smallstep step-ca: https://<host>:9000/acme/<provisioner>/directory
• HashiCorp Vault's PKI engine: https://<host>:8200/v1/pki/acme/directory
• acme2certifier, an ACME server that passes requests on to a CA that does not speak ACME. That is the way to get certificates from Active Directory Certificate Services, even with only the Certification Authority role installed.

Before acme.sh runs, the node reads the directory itself, waiting at most 15 seconds, so a mistake fails at once and says what to fix: a certificate it does not trust, a server it cannot reach, or an address that is not an ACME directory. Without this, acme.sh retried for ten minutes and then reported only a timeout.

The CA list, as acme.sh has it

• Buypass is gone. It stopped issuing on 31 October 2025, and acme.sh dropped it in 3.1.2, after which a Buypass account failed every request. Such an account now says so in the account list, its renewals fail with that reason, and it cannot be saved until another CA is chosen.
• Added: Google's test CA (google_test), SSL.com (sslcom) and Actalis (actalis).
• Google, SSL.com and Actalis need EAB credentials. An account for one of them is now refused without an EAB key ID, instead of failing at registration.

Renewal follows acme.sh's plan

Besides the rounds every Renewal check interval (a day by default), the node checks every ten minutes for a certificate acme.sh had planned to renew by then, and renews it. step-ca issues certificates for 24 hours by default and acme.sh renews them an hour before they end, so a daily round alone would usually miss that hour. A failed attempt is tried again after an hour, not every ten minutes.

Active Directory Certificate Services, with nothing else to run

An ACME account can now have Active Directory Certificate Services as its certificate authority. Under Settings › ACME Settings, or while creating the account in Request a certificate, fill in the CA's server and name, the certificate template (WebServer by default), the enrollment method — MS-ICPR, the RPC interface certreq uses, which works with a CA that has only the Certification Authority role; or web enrollment through /certsrv — the authentication (Kerberos or NTLM; NTLM or basic for web enrollment), and a service account allowed to enroll.

AD CS does not speak ACME, so the node brings acme2certifier along. At an issuance it writes acme2certifier's configuration, starts it on localhost — under a second — points acme.sh at it, and stops it when acme.sh is done. The configuration holds the password, so it is written with mode 0600 and removed afterwards. No new service, no port opened, and several AD CS accounts take turns.

• Test the connection to the CA asks the CA for nothing but a connection, with the account as typed, so a wrong name, a closed port or a refused login shows before the first certificate is requested.
• Extra acme2certifier settings take any acme_srv.cfg setting the fields do not cover — a handler timeout, dns_server_list, allowed_domainlist, the Kerberos keytab options — laid over the generated configuration. Show the configuration shows the result, password masked.
• When enrollment fails, the error names what acme2certifier said: Failed to connect to endpoint mapper, a refused login, or the CA's answer. acme2certifier's output is kept with the attempt's Log.
• The container image carries acme2certifier and Impacket (which MS-ICPR enrolls through), without Impacket's example tools that virus scanners flag. A node installed with install.sh or from a package fetches both when its service starts (new in beta.4, above).

Everything up to the CA — acme2certifier starting, the account, the order, HTTP-01 validation, the enrollment call — has been exercised; the enrollment itself has not been tried against a real AD CS. If yours works, or does not, say so in an issue.

Fixed since beta.2

Active Directory Certificate Services

• Extra acme2certifier settings can no longer name code to load. acme2certifier takes a file's path for handler_module, hooks_module and eab_handler_module as readily as a module's name, so that box was a way to run any file on the node as root for whoever can edit an account — an MCP client allowed to make changes among them. A *_module must now be one of acme2certifier's own; handler_file, hooks_file, eab_handler_file and log_file are refused, and so is a krb5_kinit_path outside the system's. The extra settings are also a secret to MCP now.
• Enterprise Linux: the on-demand install could not succeed on .rpm systems: acme2certifier's .rpm is two packages and installs under /opt/acme2certifier, and the node fetched one and looked in /var/www. Both are now installed and found. Tried on Rocky Linux 9.
• The Log holds acme2certifier's output. It was collected after the log had been put together, so only the one-line reason in the error survived. Its last lines now follow acme.sh's.
• Test the connection to a web enrollment server no longer reports a refused login when IIS offers Negotiate before NTLM, as it does by default. And while a certificate is being requested, the test says so instead of waiting behind it.
• Show the configuration masks every setting that holds a credential, by name, rather than replacing the password's text wherever it occurred.

Renewal

• A certificate first issued with an EC key and later switched to RSA was judged by the plan in the _ecc folder acme.sh leaves behind, forever in the past, and so counted as due at every ten-minute check. The plan is now read from the folder of the key type the certificate has.

The guide: Your own certificate authority and Active Directory Certificate Services.