Beta. Only nodes with Also offer beta versions ticked (Settings → Updates) are offered this. Package installs (Proxmox CT, .deb/.rpm) need GH_INCLUDE_PRERELEASE=1 for the CT script; the Updates page picks it up on a node that has asked for betas.
2.2.0-beta.2: Active Directory Certificate Services, built in
Everything in 2.2.0-beta.1, and:
Certificates from AD CS, with nothing else to run
An ACME account can now have Active Directory Certificate Services as its certificate authority. Under Settings › ACME Settings, or while creating the account in Request a certificate, fill in the CA's server and name, the certificate template (WebServer by default), the enrollment method — MS-ICPR, the RPC interface certreq uses, which works with a CA that has only the Certification Authority role; or web enrollment through /certsrv — the authentication (Kerberos or NTLM; NTLM or basic for web enrollment), and a service account allowed to enroll.
AD CS does not speak ACME, so the node brings acme2certifier along. At an issuance it writes acme2certifier's configuration, starts it on localhost — under a second — points acme.sh at it, and stops it when acme.sh is done. The configuration holds the password, so it is written with mode 0600 and removed afterwards. No new service, no port opened, and several AD CS accounts take turns.
- Test the connection to the CA asks the CA for nothing but a connection, with the account as typed, so a wrong name, a closed port or a refused login shows before the first certificate is requested.
- Extra acme2certifier settings take any
acme_srv.cfgsetting the fields do not cover — a handler timeout,dns_server_list,allowed_domainlist, the Kerberos keytab options — laid over the generated configuration. Show the configuration shows the result, password masked. - When enrollment fails, the error names what acme2certifier said: Failed to connect to endpoint mapper, a refused login, or the CA's answer. acme2certifier's output is kept with the attempt's Log.
- The container image carries acme2certifier and Impacket (which MS-ICPR enrolls through), without Impacket's example tools that virus scanners flag. A node installed with
install.shor from a package fetches acme2certifier at the first issuance, or from Install acme2certifier now on the Certificates page, which also says when it is missing.
Everything up to the CA — acme2certifier starting, the account, the order, HTTP-01 validation, the enrollment call — has been exercised; the enrollment itself has not been tried against a real AD CS. If yours works, or does not, say so in an issue.
The guide: Active Directory Certificate Services.