Setting Up SSL Certificates in Proxmox with the Built-in ACME

Proxmox VE has built-in support for an ACME client, which allows you to automatically obtain and renew SSL certificates from Let’s Encrypt. This significantly simplifies securing the Proxmox web interface and API.

If you liked this article, you can support the author by becoming a sponsor on Boosty (link in the contacts section).

📋 Requirements

#

• A public domain pointed at the IP address of your Proxmox server.
• Access to DNS records (DNS challenge).
• Proxmox VE version 6.2 or higher.

🔐 Why use ACME

#

• Automatic certificate renewal.
• Free of charge.
• Eliminates browser warnings about an insecure connection.
• Increases the security of access to the Proxmox web interface.

Introduction

#

Since version 6.2, Proxmox VE includes built-in support for ACME - automatic issuance of SSL certificates from Let’s Encrypt. One of the most reliable and universal ways to verify a domain is the DNS Challenge, especially if you don’t want to or can’t open ports 80/443 to the internet.

In this article, we’ll walk step by step through setting up the ACME client in Proxmox to obtain an SSL certificate using a DNS API provider.

Requirements

#

• A public domain pointed at the IP address of your Proxmox server.
• Access to DNS records (DNS challenge).
• Proxmox VE version 6.2 or higher.
• A DNS provider that supports an API (for example, Cloudflare, DuckDNS, DigitalOcean, etc.)
• Access to Proxmox via SSH or through the web interface

Step 1: Enabling ACME in Proxmox

#

Creating an account

#

Open the Proxmox web interface and go to Datacenter → ACME → Accounts

In the Accounts section, create an account by filling in all the required fields.

Registering a plugin

#

In the Datacenter → ACME → DNS Plugin section, click Add and select the DNS host you need, for example Cloudflare. In the dropdown menu, enter the necessary data you received from your DNS host.

Step 2: Issuing the certificate

#

Go to:

Datacenter → node_name → System → Certificates

Click ACME → Add

Parameters:

Domains: proxmox.example.com

ACME Account: the name of the account you created in step 1 Plugin: the name you gave your plugin Click Create

Proxmox will automatically start verification and, upon successful completion, will install the certificate.

Conclusion

#

Using the DNS Challenge to issue an SSL certificate is a secure and flexible way to protect the Proxmox interface, especially if it’s not accessible from outside. Integrating ACME into Proxmox makes this process simple and fully automatic.

If you use public DNS providers with API support, setup will take no more than 5 minutes.

Useful links

#

• Proxmox ACME documentation
• List of supported DNS plugins
• Let’s Encrypt