acme.sh - Where to deploy issued cert files

[master-kw]

I run NPM with sqlite.db in a Docker container. To avoid having to open ports, I prefer acme.sh.

I successfully issued my cert via DNS challenge and all cert files are stored in the 'download folder'.

• ca.cer
• mydomain.com.cer
• mydomain.com.conf
• mydomain.com.csr
• mydomain.com.csr.conf
• mydomain.com.key
• fullchain.cer

I'm just not sure which deploy variant I have to choose to install the certificate in NPM so that it is recognized and automatically renewed?

There are two variants:
a) deploy to docker containers
or
b) Deploy ssl certs to nginx

Is this the right way at all or do I have to approach this completely differently with acme.sh?

Regards,
Oliver

[master-kw]

I played a little trick ;) Can it work this way?

I solved it using the 'cert docker to docker' variant.

NPM creates the custom certs under /data/custom_ssl/npm-x. Now I simply created a directory 'npm-1' manually and specified this path as the target in the deploy book.

Then I updated the NPM webGUI and it accepted the cert with the corresponding validity.

The renew process is initiated by acme.sh, so that might work?

[nillebor]

I don't think it will work.
The certificates are not integrated in the database.

What are the names of the files in the output folder?
The instructions you described do not work in new containers here.

Where is the certificate shown as valid?
Can you put this in another container? Copying files manually should be enough.

Can you take screenshots?

Apparently there will be no new version of NPM with acme.sh give. The thread has already disappeared. This one was almost 3 year old. I think it would need an import function for the database to be integrated.

[master-kw]

I took a wrong turn and am now using the DNS challenge from NPM. acme.sh is no longer necessary.

[nillebor]

Thanks for the answer.
Then you should also correct and finish the post and do not wait any further for help.

I'm still hoping for a version with acme.
But I think it's all about maintenance here.
It has become very quiet around the npm.

[master-kw]

cleared

[jmtremblay2]

Related, but wanted to share

I wanted to programmatically update my certificates that I get from my registrar. Currently testing but my idea is to

1. from the data folder, read the expiration of the current certificate for my domain
2. if close to expiration, call my registrar's API to get new certs.
3. if new certificates have been issues, update the custom-ssl folder with my new certificates
4. write a new expires_on in the database.

https://github.com/jmtremblay2/porkbun/blob/certificates/retrieve_ssl.py