Issue other ACME certificates with Caddy

[balloon (🎈 BALLOON | FU-SEN)]

Caddy typically attempts to issue Let’s Encrypt or ZeroSSL certificates.
However, recently we have run into rate limiting with Let’s Encrypt, and seem to be having some trouble with ZeroSSL.

Recently, the number of other ACME certificate options has increased, so I thought it would be a good idea to use them with Caddy.

As discussed in past topics, Buypass certificates are easy to use with Caddy.

Configure key type to use when creating ACME account (for using Buypass)

@matt Maybe many people know that besides Let’s Encrypt, there’s another CA provides free SSL certificates with ACME: Buypass GO I’ve tried to configure caddy to use it (Buypass requires an email address): tls youthdna@live.com { ca https://api.test4.buypass.no/acme/directory } However, I got this error: Aug 14 01:51:31 server caddy[1169]: 2020/08/14 01:51:31 [ERROR] Making new ACME client: acme: error: 0 :: POST :: https://api.test4.buypass.no/acme-v02/new-acct :: urn:ietf:params:acme:…

What about other ACME endpoints? acme.sh contains information about some ACME
For example, what about ssl.com ACME?:
GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol

I think some people are choosing Caddy to use ZeroSSL, so I think this information sharing will be useful.

Additionally, if you want to use ZeroSSL certificates with Caddy:

Using ZeroSSL's ACME endpoint

ZeroSSL is an ACME-compatible certificate authority alternative to Let’s Encrypt. ZeroSSL’s ACME endpoint is already compatible with Caddy because it implements RFC 8555. But Caddy 2.2 has more convenient support for ZeroSSL because it will automatically generate the necessary External Account Binding (EAB) credentials for you. As of Caddy 2.2, there are several ways to use ZeroSSL. I’ll demonstrate the Caddyfile config, but you can use caddy adapt to get the equivalent JSON. Using global op…

[matt (Matt Holt)]

Yeah, you can use any ACME-compatible CAs with Caddy.

Buypass works. I’ve tested that.

Google Trust Services also works.

Some CAs will require an External Account Binding (EAB) that you’ll have to add to your config first.

But yeah, you can absolutely use any ACME CAs you’d like.

What issues are you having with ZeroSSL, exactly? Anything like this?

[balloon (🎈 BALLOON | FU-SEN)]

It might be a good idea to compile more specific information about this as a Wiki. someone will need it.

@matt

What issues are you having with ZeroSSL, exactly? Anything like this?

I also had a problem issuing certificates with ZeroSSL a while ago. When I log in to my account I see the following message:

Note: Your account is holding more than 100 ACME certificates. For using the Dashboard or API with this amount of ACME certificates you have to upgrade at least to the ZeroSSL basic plan.

Related topics have been posted in the past:

ZeroSSL paid plans

I was under the impression that with issuing certs via Acme allowed for unlimited 90 day certs at no charge but have recently been told that I must upgrade to a paid plan as I have gone over 100 certs. I was alerted when I logged into the ZeroSSL dashboard. I exchanged emails with ZeroSSL with not much luck and in the end had to upgrade to make sure everything kept working BUT Their ACME documentation page (ACME Documentation - ZeroSSL) says that it is unlimited 90 day certs at no charge, On…

ZeroSSL doesn’t mention it prominently, but it was recently secretly added to this page
(Perhaps this is their strategy to encourage you to purchase a paid plan…):

API Method: List Certificates - ZeroSSL

Note
In case you have more than 100 ACME certificates you need at least a ZeroSSL basic plan in order to work with those in Dashboard or API. In case you have more than 100K ACME certificates you need at least a ZeroSSL premium plan in order to work with those in Dashboard or API.

and ZeroSSL may be experiencing problems with the ACME issuance process as the number of users increases.

So I had to revert to Let’s Encrypt (=LE). As a result, (LE rate limits were somewhat relaxed at that time)
some subdomains (free domains, For example FreeDNS) were suspended.

Note: If your domain uses many subdomains and you encounter LE rate limiting, I recommend applying for LE’s rate limiting form. In many cases, LE will approve this and extend the limit.

Rate Limit Adjustment Request - Formstack

I learned that other ACMEs have recently increased, and I was also able to get a VPS to test them. I recently tested the Byepass certificate. Some subdomains were restored at that time.

[Jamie_Richards]

Hey there. The 100 limit only applies to the API and dashboard, we’ve got far more than 100 certs on the free plan. I went through similar issues a while back where certs were not being renewed or created, in the end I put it down to ZeroSSL issues as having a paid account made no difference - ZeroSSL actually told me I needed to upgrade which was not true.

[balloon (🎈 BALLOON | FU-SEN)]

Thank you for sharing your experience.
I’ll try ZeroSSL issuance with Caddy later.

[balloon (🎈 BALLOON | FU-SEN)]

Okay. I am looking at a ZeroSSL certificate issued by Caddy.

But issuing ZeroSSL certificates took longer than other certificates. As expected, the ZeroSSL ACME server appears to be busy.
I will try using ZeroSSL and Byepass with Caddy. I’ll probably try other ACMEs as well.
Thank you for supporting ZeroSSL thus far.

We will return to the original topic in subsequent comments.

[matt (Matt Holt)]

@balloon

But issuing ZeroSSL certificates took longer than other certificates. As expected, the ZeroSSL ACME server appears to be busy.

This is a known issue – unfortunately they’re bottlenecked by their software vendor.

Anyway, yeah, what would you like us to update in the docs?

The only real thing to configure is the CA URL. (And EAB if they require it. But that’s up to the CA to document, not us.)

[balloon (🎈 BALLOON | FU-SEN)]

@matt

what would you like us to update in the docs?

ACME and certificates currently available to Caddy and their Caddyfile settings.

Using ZeroSSL's ACME endpoint

ZeroSSL is an ACME-compatible certificate authority alternative to Let’s Encrypt. ZeroSSL’s ACME endpoint is already compatible with Caddy because it implements RFC 8555. But Caddy 2.2 has more convenient support for ZeroSSL because it will automatically generate the necessary External Account Binding (EAB) credentials for you. As of Caddy 2.2, there are several ways to use ZeroSSL. I’ll demonstrate the Caddyfile config, but you can use caddy adapt to get the equivalent JSON. Using global op…

This summary is great, Please create wiki pages for other similar certificates.
And here is a list of the types of certificates.

GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME...

acme.sh’s README.md and Wiki are ideal.
Please disclose that many certificates can be used with Caddy.
It can be used as a promotional material as a feature of Caddy.

[matt (Matt Holt)]

While I don’t think it’s our job on the Caddy website to maintain a list of all RFC 8555-compliant CAs, I’ll try to emphasize on our new site that any ACME (RFC 8555-compliant) CA can be used.

Maybe we could link to https://www.acmeisuptime.com/.