avandeputte/haproxy-manager v2.2.0

2.2.0: certificates from your own CA, Active Directory Certificate Services, DNS alias mode, 36 more recipes

on GitHub

2.2: certificates from your own CA, Active Directory Certificate Services, DNS alias mode, 36 more recipes

The guide covers all of it: Your own certificate authority, Active Directory Certificate Services, DNS alias mode, recipes. Upgrading a cluster: update every node (see Updates).

Your own ACME server

An ACME account can now use custom as its certificate authority: any ACME server, by the URL of its directory. Under Settings › ACME Settings, or while creating the account in Request a certificate:

• ACME directory URL, such as https://ca.example.lan/directory.
• CA certificate to trust (optional): the PEM certificate of the CA that signed the ACME server's own HTTPS certificate. It is added to the system's trusted CAs for that account's runs only.
• EAB key ID and HMAC key, if your server asks for them.

Tried end to end with:

• Smallstep step-ca: https://<host>:9000/acme/<provisioner>/directory
• HashiCorp Vault's PKI engine: https://<host>:8200/v1/pki/acme/directory
• acme2certifier, an ACME server that passes requests on to a CA that does not speak ACME.

Before acme.sh runs, the node reads the directory itself, waiting at most 15 seconds, so a mistake fails at once and says what to fix: a certificate it does not trust, a server it cannot reach, or an address that is not an ACME directory. Without this, acme.sh retried for ten minutes and then reported only a timeout.

Active Directory Certificate Services, with nothing else to run

An ACME account can now have Active Directory Certificate Services as its certificate authority. Fill in the CA's server and name, the certificate template (WebServer by default), the enrollment method, the authentication, and a service account allowed to enroll.

• Enrollment method: MS-ICPR, the RPC interface certreq uses, which works with a CA that has only the Certification Authority role; or web enrollment through /certsrv.
• Authentication: Kerberos or NTLM for MS-ICPR; NTLM or basic for web enrollment.

AD CS does not speak ACME, so the node brings acme2certifier along. At an issuance it writes acme2certifier's configuration, starts it on localhost, points acme.sh at it, and stops it when acme.sh is done. The configuration holds the password, so it is written with mode 0600 and removed afterwards. No new service, no port opened, and several AD CS accounts take turns.

• Test the connection to the CA asks the CA for nothing but a connection, with the account as typed, so a wrong name, a closed port or a refused login shows before the first certificate is requested.
• Extra acme2certifier settings take any acme_srv.cfg setting the fields do not cover: a handler timeout, dns_server_list, allowed_domainlist, the Kerberos keytab options. They cannot name code or a log file to load: a *_module must be one of acme2certifier's own. Show the configuration shows the result, with every credential masked.
• When enrollment fails, the error names what acme2certifier said: Failed to connect to endpoint mapper, a refused login, or the CA's answer. acme2certifier's output is kept with the attempt's Log.
• Where acme2certifier comes from. The container image carries it, with Impacket (which MS-ICPR enrolls through) and without Impacket's example tools that virus scanners flag. A node installed from a package (.deb, .rpm, the Proxmox container) or with install.sh fetches both when its service starts and finds them missing. That takes about a minute, in the background, and needs the node to reach github.com. A test or a certificate request made during that minute waits for it.

Requested in #26, where Thommy05 tested it against a real AD CS and reported that it works.

DNS alias mode

Contributed by GGeorggg (PR #29), with fixes on top.

When the zone a certificate's names are in has no API, or its credentials should not sit on a load balancer, the validation record can be made in another zone. This is acme.sh's DNS alias mode. Point _acme-challenge.<name> at _acme-challenge.<alias zone> with a CNAME, once, and give the DNS-01 challenge type the alias zone's hook and credentials and the alias in the new Challenge alias domain field. The field is in the challenge type editor and in Request a certificate.

• One alias serves every name on every certificate that uses the challenge type.
• One alias per name, separated by spaces, is paired with a certificate's names in order. no in a position leaves that name to its own zone.
• A name pasted with _acme-challenge. in front, or with a trailing dot, is stored as the alias it means.
• A list of aliases that does not fit a certificate's names is refused when the challenge type or the certificate is saved, and in the wizard, rather than failing at the next renewal.

The CA list, as acme.sh has it

• Buypass is gone. It stopped issuing on 31 October 2025, and acme.sh dropped it in 3.1.2, after which a Buypass account failed every request. Such an account now says so in the account list, its renewals fail with that reason, and it cannot be saved until another CA is chosen.
• Added: Google's test CA (google_test), SSL.com (sslcom) and Actalis (actalis).
• Google, SSL.com and Actalis need EAB credentials. An account for one of them is now refused without an EAB key ID, instead of failing at registration.
• No EAB fields for a CA that has no EAB. Let's Encrypt and its test CA do not use external account binding, so EAB key ID and EAB HMAC key are no longer shown for them, in the account editor or in Request a certificate. Values left over on such an account are dropped when it is saved and are not passed at registration.

Renewal follows acme.sh's plan

Besides the rounds every Renewal check interval (a day by default), the node checks every ten minutes for a certificate acme.sh had planned to renew by then, and renews it. step-ca issues certificates for 24 hours by default and acme.sh renews them an hour before they end, so a daily round alone would usually miss that hour. A failed attempt is tried again after an hour, not every ten minutes.

36 more recipes

Start from a recipe now offers 207 services. Each new one was checked against the application's own documentation or source: the port, the health check, and what the application has to be told when it sits behind a proxy. That last part is in the recipe's notes.

• Windows: Microsoft Exchange (checked with its healthcheck.htm), AD FS (passed through, checked with /adfs/probe on port 80), Remote Desktop Gateway (passed through, each client kept on one gateway), Windows Admin Center, Microsoft SQL Server.
• Infrastructure: Synology DSM, Proxmox Backup Server, Proxmox Mail Gateway, Headscale, Technitium DNS, OpenMediaVault, Minecraft (Java Edition).
• Collaboration: Collabora Online, ONLYOFFICE Docs, Jitsi Meet, Zulip, Zammad, OpenProject.
• Developer and data: code-server, JupyterHub, Metabase, Apache Superset, Sentry, GlitchTip, Semaphore UI, AWX, NetBox, Wazuh dashboard.
• Home automation and game panels: openHAB, ioBroker, Pterodactyl Panel, Pelican Panel.
• Databases and messaging: PgBouncer, Oracle Database, NATS (checked with /healthz on its monitoring port), EMQX (checked with /status on its dashboard port).

Coming from a 2.2.0 beta

2.2.0 is 2.2.0-beta.6 with the version changed. A node on any 2.2 beta is offered it like any other update.