How to obtain TLS certificate using ACME protocol on Linux

Preparing to obtain the certificate

Using ACME is very simple, but it requires a small amount of preparation. Before you start using it, please read the following paragraphs.

Obtaining credentials for authentication

DigiCert's ACME implementation uses authentication via External Account Binding (EAB), which means you receive your own credentials from DigiCert. You can easily obtain these credentials (ACME credentials) in your SSLmarket customer account.

ACME credentials consist of a Key Identifier and an HMAC key, which is your secret for authenticating against the existing account. You need these details together with the ACME endpoint URL for the ACME client (Certbot).

Summary of certificate validation

All certificates issued by DigiCert are validated. Some minimally (DV certificates), others require organization validation (OV and EV). ACME is no exception and this validation is used here as well.

• Domain DV certificates are issued immediately; just create ACME credentials for the DV product and use them. DCV validation is performed via the HTTP-01 method and the certificate is issued right away.
• OV and EV certificates require a validated organization and validation of the domain used, which is bound to the organization. If validation is not completed, the ACME request cannot be completed either.
  • Domains can be validated automatically using HTTP-01, or they can be validated in advance using DNS or e-mail (in that case, contact us). DCV works exactly the same way you are used to.
  • The organization must be validated before requesting a certificate, otherwise the request will wait for its completion (which will end in a timeout). We recommend that after activating the ACME account you wait for your organization to be validated by DigiCert and consult the status with SSLmarket support.

For OV and EV, you can start using ACME as soon as the organization is validated (validation of domains and companies is valid for 13 months).

Certbot

Certbot is the most popular ACME client, which supports the main Linux web servers.

Preparing Certbot on the server

Install Certbot on your server. We recommend using modules appropriate for your webserver type. Modules make it easier to select the target site for deploying the certificate and can work directly with the server configuration (making certificate installation easier).

The Certbot package is commonly installed in Linux distributions, but remove this default package. To use DigiCert's EAB ACME, you need to use the package from Snap; other variants may not be functional. Install it as follows:

snap install certbot --classic

Note: On the Certbot official homepage you can choose your server's operating system and follow step-by-step installation instructions.

Issuing and installing certificates

Online and in the Certbot documentation you will find many examples of how to use it to obtain a certificate. However, since DigiCert's ACME works in the aforementioned EAB mode, the command also needs to be supplemented with the ACME URL and your two ACME credentials obtained in your administration. Otherwise it will not work.

Using Terminal, request the certificate by entering command below:

sudo certbot --apache --register-unsafely-without-email --server "Your ACME Directory URL" -d www.domainname.co.uk -d domainname.co.uk

The command works in this manner:

• Certbot – executes Certbot
• --apache – select Apache plugin which installs the certificate.
• --register-unsafely-without-email – enables skipping of ACME account creation.
• --server – selects ACME server used to fulfill your request by ACME Directory URL
• -d – full domain name for which you want the certificate issued. If you do not use this parameter, Cerbot will prompt you to confirm domain names which you want to include in your request based on the vhost configuration

After entering the command, you will be prompted whether you want to enable forced redirect to HTTPS protocol on the domain:

Output
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-------------------------------------------------------------------------------
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
-------------------------------------------------------------------------------
Select the appropriate number [1-2] then [enter] (press 'c' to cancel):

You enter the number and confirm it by pressing ENTER. Your configuration will be set and it will be loaded after the web server reboots. Afterwards, you will be informed that your request was successfully fulfilled and where are your certificates located.

Certbot installs the necessary Intermediate certificate, you can use our online tool for verification of correct installation.

ACME.sh

You can also easily use DigiCert's ACME with the ACME.sh tool. Unlike Certbot, it is "leaner" and it is not necessary to install so many dependencies on the server.

Creating a separate system user under which it will "run":

useradd -r -s /bin/bash -m -d /home/acmeuser acmeuser
mkdir -p /home/acmeuser/.acme.sh
chown -R acmeuser:acmeuser /home/acmeuser/.acme.sh
echo 'acmeuser ALL=(ALL) NOPASSWD: /usr/sbin/service nginx reload' | sudo tee /etc/sudoers.d/acmeuser

then log in as the user: sudo su - acmeuser

Installing acme.sh

Now install the ACME client using the package downloaded from the web.

wget https://get.acme.sh -O acme.sh
sh acme.sh

The installation performs:

• installation of the script itself
• setup of a cron task (can be checked under the acmeuser user with the crontab -e command)

Then register the certification authority:

acme.sh --register-account --server https://one.digicert.com/mpki/api/v1/acme/v2/directory --eab-kid xxxxxx --eab-hmac-key yyyyyy

Before actually requesting certificate issuance, it is still necessary to check (and possibly configure) that the acmeuser user has access to the target folder where the certificates are located for nginx, apache, as well as other services on the server. The solution is to create a new ssladmins group:

sudo groupadd ssladmins
sudo usermod -aG ssladmins root
sudo usermod -aG ssladmins acmeuser
sudo chown root:ssladmins /etc/nginx/ssl/
sudo chmod 770 /etc/nginx/ssl/

Another solution would be to use visudo to grant the acmeuser user permissions to copy files to the given folders without a password.

Requesting certificate issuance

acme.sh --issue --server https://one.digicert.com/mpki/api/v1/acme/v2/directory -d dev.inmail.cz --days 365 -w /www/sites/inmail/dev/current/web/ --key-file /etc/nginx/ssl/dev.inmail.cz.key --fullchain-file /etc/nginx/ssl/dev.inmail.cz.cer --force --log --reloadcmd "sudo systemctl reload nginx"

List of issued and installed certificates:

acme.sh --list

Do you have questions?

Do not hesitate to contact our customer support, who will advise and help you.