Let’s Encrypt with DNS validation

Let’s Encrypt via DNS validation (Proxmox)

With our DNS plugin for Proxmox you can have Let’s Encrypt certificates renewed automatically through the DNS-01 challenge. This works without HTTP access and is ideal for the Proxmox management interface, internal services and systems behind a firewall.

Requirements

• Your domain must point to our nameservers (DNS managed at FireStorm)
• API access must be enabled (under admin.firestorm.ch → Customer profile → API access)
• Have your customer number and your API key ready

1. Install the plugin

Download the plugin to your Proxmox host:

curl -o /usr/share/proxmox-acme/dnsapi/dns_firestorm.sh https://api.firestorm.ch/downloads/dns_firestorm.txt

If you run a Proxmox cluster, the plugin must be installed on every node.

The plugin definition also has to be added to the schema file:

python3 -c "
import json
f='/usr/share/proxmox-acme/dns-challenge-schema.json'
d=json.load(open(f))
d['dns_firestorm']={'name':'FireStorm DNS','fields':{
'FST_Key':{'description':'FireStorm customer number','type':'string'},
'FST_Secret':{'description':'FireStorm API Key','type':'string'}}}
json.dump(d,open(f,'w'),indent=2,sort_keys=True)
print('OK')
"

2. Create an ACME account

Create a new account under Datacenter → ACME → Accounts → Add. Enter your e-mail address and accept the Let’s Encrypt terms of service.

3. Create the DNS challenge plugin

Under Datacenter → ACME → Challenge Plugins → Add:

This plugin works for all domains in your account, you only need a single plugin in the datacenter.

4. Configure the certificate

Under Node → System → Certificates → ACME:

• Select the ACME account you created
• Add a domain: enter the hostname (for example proxmox.yourdomain.ch), challenge type DNS, select the plugin

5. Order the certificate

Click Order Certificates Now. Proxmox sets the DNS record automatically, waits for the validation and installs the certificate.

The certificate is renewed automatically 30 days before it expires.

Troubleshooting

«dns_firestorm» does not appear in the selection
Make sure that both the .sh file and the schema definition are installed (see step 1). Reload the Proxmox web interface.

«Invalid credentials»
Check that customer number and API key are correct. You find the API key under admin.firestorm.ch → Customer profile.

«Zone not found»
The domain must point to our nameservers and a DNS zone must exist in your account.

The certificate is not renewed
Proxmox attempts the renewal automatically 30 days before expiry. Check the status under Node → System → Certificates.

Further guides

For Cert Warden see the article Let’s Encrypt with Cert Warden. How to have a DNS record updated automatically by a MikroTik router is described in the article DynDNS with a MikroTik router.