Openbao as ACME Client or Proxy

[smehrens]

Many CA Providers implement acme protocol.

It would be great if openbao implement acme client features to request, renew and store TLS Certs from a acme Server.

• Internal servers would be able to get a valid certificate.
• User could get a x509 / smime Cert..
• Zertificates are stored secure in openbao.
• Permission Policies could control Certificate requests.
• DNS and HTTP Challenge could be done on a single system.

I am currently written certbot scripts to manage acme Certs outside and write them to openbao for storage and access control, but the certs are not protected by certbot in any way.

Thanks

[cipherboy]

Hey @smehrens -- have you seen https://github.com/remilapeyre/vault-acme ? It is not very active, but I think it solves this need.