avandeputte/haproxy-manager v2.2.0-beta.3

2.2.0-beta.3: certificates from your own CA, Active Directory Certificate Services included

on GitHub

Beta. Only nodes with Also offer beta versions ticked (Settings → Updates) are offered this. Package installs (Proxmox CT, .deb/.rpm) need GH_INCLUDE_PRERELEASE=1 for the CT script; the Updates page picks it up on a node that has asked for betas.

2.2.0-beta.3: certificates from your own CA, Active Directory Certificate Services included

This beta replaces 2.2.0-beta.1 and beta.2 and holds everything they did, with the fixes from a review of both. It also includes everything in 2.1.1: what MCP shows and logs, uploaded certificates, IPv6 binds, the tunnel timeout, redirects.

Your own ACME server

An ACME account can now use custom as its certificate authority: any ACME server, by the URL of its directory. Under Settings › ACME Settings, or while creating the account in Request a certificate:

• ACME directory URL, such as https://ca.example.lan/directory.
• CA certificate to trust (optional): the PEM certificate of the CA that signed the ACME server's own HTTPS certificate. It is added to the system's trusted CAs for that account's runs only.
• EAB key ID and HMAC key, if your server asks for them.

Tried end to end with:

• Smallstep step-ca: https://<host>:9000/acme/<provisioner>/directory
• HashiCorp Vault's PKI engine: https://<host>:8200/v1/pki/acme/directory
• acme2certifier, an ACME server that passes requests on to a CA that does not speak ACME. That is the way to get certificates from Active Directory Certificate Services, even with only the Certification Authority role installed.

Before acme.sh runs, the node reads the directory itself, waiting at most 15 seconds, so a mistake fails at once and says what to fix: a certificate it does not trust, a server it cannot reach, or an address that is not an ACME directory. Without this, acme.sh retried for ten minutes and then reported only a timeout.

The CA list, as acme.sh has it

• Buypass is gone. It stopped issuing on 31 October 2025, and acme.sh dropped it in 3.1.2, after which a Buypass account failed every request. Such an account now says so in the account list, its renewals fail with that reason, and it cannot be saved until another CA is chosen.
• Added: Google's test CA (google_test), SSL.com (sslcom) and Actalis (actalis).
• Google, SSL.com and Actalis need EAB credentials. An account for one of them is now refused without an EAB key ID, instead of failing at registration.

Renewal follows acme.sh's plan

Besides the rounds every Renewal check interval (a day by default), the node checks every ten minutes for a certificate acme.sh had planned to renew by then, and renews it. step-ca issues certificates for 24 hours by default and acme.sh renews them an hour before they end, so a daily round alone would usually miss that hour. A failed attempt is tried again after an hour, not every ten minutes.

Active Directory Certificate Services, with nothing else to run

An ACME account can now have Active Directory Certificate Services as its certificate authority. Under Settings › ACME Settings, or while creating the account in Request a certificate, fill in the CA's server and name, the certificate template (WebServer by default), the enrollment method — MS-ICPR, the RPC interface certreq uses, which works with a CA that has only the Certification Authority role; or web enrollment through /certsrv — the authentication (Kerberos or NTLM; NTLM or basic for web enrollment), and a service account allowed to enroll.

AD CS does not speak ACME, so the node brings acme2certifier along. At an issuance it writes acme2certifier's configuration, starts it on localhost — under a second — points acme.sh at it, and stops it when acme.sh is done. The configuration holds the password, so it is written with mode 0600 and removed afterwards. No new service, no port opened, and several AD CS accounts take turns.

• Test the connection to the CA asks the CA for nothing but a connection, with the account as typed, so a wrong name, a closed port or a refused login shows before the first certificate is requested.
• Extra acme2certifier settings take any acme_srv.cfg setting the fields do not cover — a handler timeout, dns_server_list, allowed_domainlist, the Kerberos keytab options — laid over the generated configuration. Show the configuration shows the result, password masked.
• When enrollment fails, the error names what acme2certifier said: Failed to connect to endpoint mapper, a refused login, or the CA's answer. acme2certifier's output is kept with the attempt's Log.
• The container image carries acme2certifier and Impacket (which MS-ICPR enrolls through), without Impacket's example tools that virus scanners flag. A node installed with install.sh or from a package fetches acme2certifier at the first issuance, or from Install acme2certifier now on the Certificates page, which also says when it is missing.

Everything up to the CA — acme2certifier starting, the account, the order, HTTP-01 validation, the enrollment call — has been exercised; the enrollment itself has not been tried against a real AD CS. If yours works, or does not, say so in an issue.

Fixed since beta.2

Active Directory Certificate Services

• Extra acme2certifier settings can no longer name code to load. acme2certifier takes a file's path for handler_module, hooks_module and eab_handler_module as readily as a module's name, so that box was a way to run any file on the node as root for whoever can edit an account — an MCP client allowed to make changes among them. A *_module must now be one of acme2certifier's own; handler_file, hooks_file, eab_handler_file and log_file are refused, and so is a krb5_kinit_path outside the system's. The extra settings are also a secret to MCP now.
• Enterprise Linux: the on-demand install could not succeed on .rpm systems: acme2certifier's .rpm is two packages and installs under /opt/acme2certifier, and the node fetched one and looked in /var/www. Both are now installed and found. Tried on Rocky Linux 9.
• The Log holds acme2certifier's output. It was collected after the log had been put together, so only the one-line reason in the error survived. Its last lines now follow acme.sh's.
• Test the connection to a web enrollment server no longer reports a refused login when IIS offers Negotiate before NTLM, as it does by default. And while a certificate is being requested, the test says so instead of waiting behind it.
• Show the configuration masks every setting that holds a credential, by name, rather than replacing the password's text wherever it occurred.

Renewal

• A certificate first issued with an EC key and later switched to RSA was judged by the plan in the _ecc folder acme.sh leaves behind, forever in the past, and so counted as due at every ten-minute check. The plan is now read from the folder of the key type the certificate has.

The guide: Your own certificate authority and Active Directory Certificate Services.