Acmelia

Guide on how to issue certificates for int.bksp.in and svc.bksp.in domains.

https://github.com/b4ck5p4c3/acmelia

Intro

As these internal zones delegated to a local name server (ns1.bksp.in), it’s tricky to issue a certificate for them:

  • HTTP-01 challenge wouldn’t work because device is behind NAT.

  • DNS-01 challenge wouldn’t work as you need to change local zone files.

Acmelia facilitates this by a clever trick:

  1. NS1 is configured for 1:1 map of _acme-challenge.*.int.bksp.in => _acme-challenge.*.int.acme-delegated.bksp.in to resolve ACME challenges on Cloudflare, rather than NS1.

  2. Acmelia implements the acmeproxy protocol to make changes in Cloudflare without exposing CF credentials to the entire fleet of devices.

Acmeproxy

Acmeproxy is a DNS-challenge strategy supported by many ACME clients:

Endpoint

Username

Password

https://acmelia.bksp.in

UUID generated by genkey

Generated by genkey

Create a new credential

Acmeproxy uses Basic auth, so you need to create a new username and password.

# Log in to ru-lnsk-ingress.
tsh ssh root@ru-lnsk-ingress

# Open acmelia deployment.
cd /root/deployments/acmelia

# Generate a new username+password pair.
# Write them down, you'll never see the password again.
docker compose exec app /acmelia genkey

# Open acmelia.yaml and add a new token entry.
nano acmelia.yaml

Here is a brief of what you’d find in that config:

zones:
  ...

tokens:
  ...

  # Add this at the end of the file
  - id: UUID_GENERATED_BY_GENKEY
    secret: HASH_GENERATED_BY_GENKEY_STARTING_WITH_$argon2
    domains:
      - my-awesome-device.int.bksp.in
      - my-awesome-service.svc.bksp.in
      - ... more

Save changes, and return to the console:

# Restart acmelia to reload config
docker compose restart

Usage

Caddy

https://mamont.int.bksp.in {
        tls {
                issuer acme {
                        dir https://acme-v02.api.letsencrypt.org/directory
                        profile tlsserver

                        dns acmeproxy https://acmelia.bksp.in {
                                username your-generated-uuid-here
                                password your-password-here
                        }
                        resolvers 1.1.1.1 8.8.8.8 9.9.9.9
                }
        }
}

acme.sh

ACMEPROXY_ENDPOINT="https://acmelia.bksp.in" \
ACMEPROXY_USERNAME="your-generated-uuid-here" \
ACMEPROXY_PASSWORD="your-password-here" \
acme.sh \
  --issue \
  --dns dns_acmeproxy \
  -d my-awesome-device.int.bksp.in