Beta. Only nodes with Also offer beta versions ticked (Settings → Updates) are offered this. Package installs (Proxmox CT, .deb/.rpm) need GH_INCLUDE_PRERELEASE=1 for the CT script; the Updates page picks it up on a node that has asked for betas.
2.2: certificates from your own CA
Your own ACME server
An ACME account can now use custom as its certificate authority: any ACME server, by the URL of its directory. Under Settings › ACME Settings, or while creating the account in Request a certificate:
- ACME directory URL, such as
https://ca.example.lan/directory. - CA certificate to trust (optional): the PEM certificate of the CA that signed the ACME server's own HTTPS certificate. It is added to the system's trusted CAs for that account's runs only.
- EAB key ID and HMAC key, if your server asks for them.
Tried end to end with:
- Smallstep step-ca:
https://<host>:9000/acme/<provisioner>/directory - HashiCorp Vault's PKI engine:
https://<host>:8200/v1/pki/acme/directory - acme2certifier, an ACME server that passes requests on to a CA that does not speak ACME. That is the way to get certificates from Active Directory Certificate Services, even with only the Certification Authority role installed.
Before acme.sh runs, the node reads the directory itself, waiting at most 15 seconds, so a mistake fails at once and says what to fix: a certificate it does not trust, a server it cannot reach, or an address that is not an ACME directory. Without this, acme.sh retried for ten minutes and then reported only a timeout.
The CA list, as acme.sh has it
- Buypass is gone. It stopped issuing on 31 October 2025, and acme.sh dropped it in 3.1.2, after which a Buypass account failed every request. Such an account now says so in the account list, its renewals fail with that reason, and it cannot be saved until another CA is chosen.
- Added: Google's test CA (
google_test), SSL.com (sslcom) and Actalis (actalis). - Google, SSL.com and Actalis need EAB credentials. An account for one of them is now refused without an EAB key ID, instead of failing at registration.
Renewal follows acme.sh's plan
Besides the rounds every Renewal check interval (a day by default), the node checks every ten minutes for a certificate acme.sh had planned to renew by then, and renews it. step-ca issues certificates for 24 hours by default and acme.sh renews them an hour before they end, so a daily round alone would usually miss that hour. A failed attempt is tried again after an hour, not every ten minutes.
The guide: Your own certificate authority.