acme2certifier

acme2certifier

acme2certifier is a development project aimed at creating an ACME protocol proxy. Its primary goal is to enable ACME services for CA servers that do not natively support this protocol.

The project consists of two main libraries:

• acme_srv/*.py – Implements ACME server functionality based on RFC 8555.
• ca_handler.py – Provides an interface to CA servers, designed to be modular for easy adaptation to various CA systems. The currently available handlers are listed below:

Supported CA Handlers

Feature Support	Enrollment (E)	Revocation ®	EAB Profiling (P)
DigiCert® CertCentral	✅	✅	✅
Dogtag Certificate System	✅	✅	✅
Entrust ECS Enterprise	✅	✅	✅
EJBCA	✅	✅	✅
Generic ACME Handler (LetsEncrypt, ZeroSSL)	✅	✅	✅
Generic CMPv2 Handler	✅	❌	❌
Generic EST Handler	✅	❌	❌
FreeIPA	✅	✅	✅
Hashicorp Vault	✅	✅	✅
HARICA CertManager	✅	✅	✅
Insta ActiveCMS	✅	✅	✅
Microsoft Certificate Enrollment Web Services	✅	❌	✅
Microsoft ICertPassage Remote Protocol (MS-ICPR)	✅	❌	✅
NetGuard Certificate Lifecycle Manager	✅	✅	✅
NetGuard Certificate Manager/Insta Certifier	✅	✅	✅
OpenSSL	✅	✅	❌
OpenXPKI	✅	✅	✅
XCA	✅	✅	✅

For the latest updates and additional documentation, visit the project’s homepage: acme2certifier on GitHub

---

📌 ChangeLog

Release notes and changelogs are available at: GitHub Releases

---

🛠 ACME Client Compatibility

The following ACME clients are regularly tested for compatibility:

• acme.sh
• acmeshell
• Caddy
• Certbot
• cert-manager
• dehydrated
• lego
• traefik
• Posh-ACME
• win-acme

Other clients are on the list for future testing. If you test additional ACME clients, feel free to raise an issue if something does not work as expected.

List of command-line parameters used for testing

---

🚀 Features

• ACME v2 RFC 8555 compliant server implementation, including:
  • RFC 8737 – TLS ALPN-01 Challenge
  • RFC 8738 – IP Address Certificates
  • RFC 8823 - Automatic Certificate Management Environment for End-User S/MIME Certificates
  • RFC 9773 - ACME Renewal Information (ARI) Extension
  • draft-ietf-acme-dns-persist - Persistent DNS TXT Record Validation
  • ACME Profiles Extension
  • TNAuthList identifiers (TNAuthList Profile)
  • RFC 9447 - Automated Certificate Management Environment (ACME) Challenges Using an Authority Token
  • Certificate Polling and Callbacks for CA servers.

Supported challenge types:

• http-01
• dns-01
• dns-persist-01 (experimental) — persistent DNS-based authorization and JIT validation (see doc for details)
• email-reply-00
• tls-alpn-01
• tkauth-01

---

📦 Installation

The fastest and most convenient way to install acme2certifier is Docker, then OS packages, then PyPI/pip:

1. Docker — ready-made images on Docker Hub and ghcr.io; compose / build, install_docker.md (images install from the .deb)
2. OS packages — DEB (/var/www/acme2certifier) or RPM (/opt/acme2certifier)
3. PyPI / pip — library + venv deploy (Apache2 Ubuntu, Nginx Ubuntu, Nginx Alma/RHEL9)
4. Local development — editable checkout + Django runserver: development.md

Lab-only security-disable acknowledgement (ACME2CERTIFIER_I_KNOW_THE_RISK): security_gate.md.

Releases publish .deb, .rpm, and PyPI (Trusted Publisher).

Software Bill Of Material

SBOMs for all containers will be automatically created during build process and stored in my SBOM repository

Contributing

Please read CONTRIBUTING.md for details on my code of conduct, and the process for submitting pull requests. Please note that I have a life besides programming. Thus, expect a delay in answering.

Versioning

I use SemVer for versioning. For the versions available, see the tags on this repository.

License

This project is licensed under the GPLv3 - see the LICENSE file for details