ACME¶

With the Automatic Certificate Management Environment (ACME) according to RFC8555 you can completely automate the order, validation and deployment of TLS certificates.

Beside the well-known certificate autority (CA) Let’s Encrypt, LiveConfig can also use any other certificate provider with ACME support.

When LiveConfig is starting, it reads all files in /etc/liveconfig/tls-*.json. To add or customize a TLS provider, create or edit the corresponding file there.

Specification of `tls-<provider>.json` file
`module`	Always `"acme"`
`version`	Always `1`
`providers`	Array of TLS providers

Specification of `provider` object
`autoRegister`	Boolean; if `true` it is allowed to automatically create an account if required (i.e. during onboarding)
`configuration`	Provider-specific configuration object (see below)
`description`	Short description of this provider (displayed in TLS provider overview, max. 255 characters)
`enabled`	Boolean to enable/disable this provider
`freeDV`	Is `true` if this CA provides (also) free TLS certificates
`logo`	Name of logo file; should be `.svg` format, located at `/var/lib/liveconfig/htdocs/`
`logoDark`	Optional differing logo file for “dark mode”
`name`	Provider name (max. 64 characters)
`priority`	Sort priority (0=most important, 100=least important)
`website`	Official website of this provider

Specification of `configuration` object
`contactRequired`	is `true` if a contact (e-mail address) is required for account creation
`authorization`	`any`: no authorization required (can be used anonymously) `eab`: External Account Binding required `eabOrContact`: External Account Binding or e-mail address (contact) required
`directory`	ACME directory URL
`products`	Array of products (see below)

Specification of `product` object
`free`	Is `true` if these certificates are free (without cost)
`id`	Unique product ID (only letters, digits and ‘-‘ allowed, max. 64 characters)
`keyDefault`	Default format for private keys (i.e. `ec-secp384r1` or `rsa-4096`)
`name`	Name of this TLS product (max. 64 characters)
`san`	Limit of Subject Alternative Names, ``-1``=unlimited, ``0``=none, else limit
`type`	Always `tls`
`validation`	`DV` (domain validation), `OV` (organization validation) or `EV` (extended validation)
`wildcard`	Is `true` if wildcard SAN (`*.example.org`) is allowed

Example for Google Trust Services:

                {
  "module": "acme",
  "version": 1,
  "providers": [
    {
      "autoRegister": false,
      "configuration": {
        "contactRequired": false,
        "authorization": "eab",
        "directory": "https://dv.acme-v02.api.pki.goog/directory",
        "products": [
          {
            "free": true,
            "id": "google",
            "keyDefault": "ec-secp384r1",
            "name": "Google Trust Services",
            "san": 50,
            "type": "tls",
            "validation": "DV",
            "wildcard": true
          }
        ]
      },
      "description": "Free domain-validated TLS certificates from Google Trust Services (requires Google Cloud account).",
      "enabled": true,
      "freeDV": true,
      "logo": "logo-google.svg",
      "name": "Google Trust Services",
      "priority": 20,
      "website": "https://pki.goog/"
    }
  ]
}

              