acme2certifier is development project to create an ACME protocol proxy. Main intention is to provide ACME services on CA servers which do not support this protocol yet. It consists of two libraries:

• acme_srv/*.py - a bunch of classes implementing ACME server functionality based on rfc8555
• ca_handler.py - interface towards CA server. The intention of this library is to be modular that an adaption to other CA servers should be straight forward. As of today the following handlers are available:
  • NetGuard Certificate Manager/Insta Certifier
  • NetGuard Certificate Lifecycle Manager
  • EJBCA
  • OpenXPKI
  • Microsoft Certificate Enrollment Web Services
  • Microsoft Windows Client Certificate Enrollment Protocol (MS-WCCE) via RPC/DCOM
  • Generic ACME protocol handler supporting Letsencrypt, BuyPass.com and ZeroSSL
  • Generic EST protocol handler
  • Generic CMPv2 protocol handler
  • Openssl
  • XCA
  • acme2dfn (external; ACME proxy for the German research network's SOAP API)

For more up-to-date information and further documentation, please visit the project's home page at: https://github.com/grindsa/acme2certifier

Release notes and ChangLog can be found at https://github.com/grindsa/acme2certifier/releases

Following acme-clients are used for regular testing of server functionality

• acme.sh
• acmeshell
• Certbot
• cert-manager
• lego
• traefik
• Posh-ACME
• win-acme

Other clients are on my list for later testing. In case you are bored, feel free to test other ACME clients and raise issues if something does not work as expected.

Command-line parameters used for testing

I am not a professional developer. Keep this in mind while laughing about my code and don’t forget to send patches.

As of today acme2certifier supports the below ACME functions:

• "directory" resource (Section 7.1.1)
• "newNonce" resource (Section 7.2)
• "newAccount" resource (Section 7.3)
  • Finding an Account URL Given a Key (Section 7.3.1)
  • Account update (Section 7.3.2)
  • Exernal Account Binding (Section 7.3.4)
  • Key Rollover (Section 7.3.5)
  • Account Deactivation (Section 7.3.6)
• "new-order" resource (Section 7.4)
• "order finalization" (Section 7.4)
• "certificate download" (Section 7.4.2)
• "authz" resource (Section 7.5)
• "challenge" resource (Section 7.5.1)
• "certificate revocation" (Section 7.6)

Starting from version 0.4 acme2certifer includes experimental support for TNAuthList identifiers and tkauth-01 challenges. Check tnauthlist.md for further information.

Starting from version 0.8 acme2certifier supports certificate polling and call backs from CA servers. These calls are not standardized but important to use acme2certifier together with classical enterprise CA servers,

Following challenge types are supported:

• http-01
• dns-01
• tls-alpn-01
• tkauth-01

Additional functionality will be added over time. If you are badly missing a certain feature please raise an issue to let me know.

The proxy can run either as plain wsgi-script on either apache or nginx or as django project. Running acme2certifier as django project allows to use other database backends than SQLite.

The fastest and most convenient way to install acme2certifier is to use docker containers. There are ready made images available at dockerhub and ghcr.io as well as instructions to build your own container. In addition rpm packages for AlmaLinux/CentOS Stream/Redhat EL 9 and deb packages for Ubuntu 22.04 will be provided with every release.

• acme2certifier in Github container repository
• acme2certifier repository at hub.docker.com
• rpm package installation on Alma Linux 9
• deb package installation Ubuntu 22.04
• Instructions to build your own container
• Installation as wsgi-script running on apache2 (Ubuntu 22.04)
• Installation as wsgi-script running on NGINX (Ubuntu 22.04)
• Installation as wsgi-script running on NGINX (Alma Linux 9)

SBOMs for all containers will be automatically created during build process and stored in my SBOM repository

Please read CONTRIBUTING.md for details on my code of conduct, and the process for submitting pull requests. Please note that I have a life besides programming. Thus, expect a delay in answering.

I use SemVer for versioning. For the versions available, see the tags on this repository.

This project is licensed under the GPLv3 - see the LICENSE file for details