plugins icon indicating copy to clipboard operation
plugins copied to clipboard
verified publisher icon opnsense

security/acme-client: Certificate “Renewal Interval” setting ignored (always uses --days 1, automatic renewals never run)

Open Curverneur opened this issue 8 months ago • 4 comments

Important notices

  • [x] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
  • [x] I have searched the existing issues, open and closed, and I'm convinced that mine is new.
  • [x] The title contains the plugin to which this issue belongs

Describe the bug:

After setting “Renewal Interval” to a value like 60 in the GUI, OPNsense still always invokes acme.sh with --days 1 and never automatically renews even when there are far fewer than 60 days left. The daily cron job simply logs:

AcmeClient: issue/renewal not required for certificate: domain.tld

To Reproduce:

  • GUI -> Services -> ACME Client -> Certificates and create or edit a certificate
  • Ensure Auto Renewal is enabled
  • Renewal Interval can not be blank; 60 days is default; verify or change the value
  • (1) Wait for the next daily cron run. Observe in the system log: running acme.sh command: … --days '1' …
  • (2) Force Issue/Renew and observe in the system log that the acme.sh call uses --days '1' and the file /var/etc/acme-client/cert-home/.../domain.tld/domain.tld.conf shows Le_RenewalDays='1'

Expected behavior:

  • The cron‐driven renewal should detect when a certificate is within 60 days of expiry and automatically run acme.sh --issue with --days 60

Environment:

(did the tests also on another opnsense instance where os-acme-client was not installed before, same behavior)

  • OPNsense 25.1.6_4-amd64
  • os-acme-client plugin version 4.9
  • acme.sh version 3.1.1

Configuration and log files:

Certificate configuration in /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.conf

 
Le_Domain='domain.tld'
Le_Alt='*.domain.tld'
Le_Webroot='dns_doapi'
Le_PreHook=''
Le_PostHook=''
Le_RenewHook=''
Le_API='https://acme-v02.api.letsencrypt.org/directory'
Le_Keylength='4096'
Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
Le_LinkOrder='https://acme-v02.api.letsencrypt.org/acme/order/id/id'
Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/id'
Le_CertCreateTime='1747450986'
Le_CertCreateTimeStr='2025-05-17T03:03:06Z'
Le_RenewalDays='1'
Le_NextRenewTimeStr='2025-05-17T03:03:06Z'
Le_NextRenewTime='1747450986'
Le_RealCertPath='/var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem'
Le_RealCACertPath='/var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem'
Le_RealKeyPath='/var/etc/acme-client/keys/6827f870236dc4.05560606/private.key'
Le_ReloadCmd=''
Le_RealFullChainPath='/var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem'

AcmeClient configuration in /conf/config.xml

 
<AcmeClient version="4.2.0">
      <settings>
        <enabled>1</enabled>
        <autoRenewal>1</autoRenewal>
        <UpdateCron>aed74c20-884a-417c-b8c8-4857a7c49af9</UpdateCron>
        <environment/>
        <challengePort>43580</challengePort>
        <TLSchallengePort>43581</TLSchallengePort>
        <restartTimeout>600</restartTimeout>
        <haproxyIntegration>0</haproxyIntegration>
        <haproxyAclRef/>
        <haproxyActionRef/>
        <haproxyServerRef/>
        <haproxyBackendRef/>
        <logLevel>extended</logLevel>
        <showIntro>0</showIntro>
      </settings>
      <accounts>
        <account uuid="f7dfe327-8f33-424c-82d1-9bc83fa9f23f">
          <id>6827f80924bdf6.96243036</id>
          <enabled>1</enabled>
          <name>ACCOUNT_NAME</name>
          <description/>
          <email>ACCOUNT_EMAIL</email>
          <ca>letsencrypt</ca>
          <custom_ca/>
          <eab_kid/>
          <eab_hmac/>
          <key>KEY</key>
          <statusCode>200</statusCode>
          <statusLastUpdate>1747449975</statusLastUpdate>
        </account>
      </accounts>
      <certificates>
        <certificate uuid="c615c865-74ac-4290-9ee5-d729adee9387">
          <id>6827f870236dc4.05560606</id>
          <enabled>1</enabled>
          <name>domain.tld</name>
          <description/>
          <altNames>*.domain.tld</altNames>
          <account>f7dfe327-8f33-424c-82d1-9bc83fa9f23f</account>
          <validationMethod>4bd080d0-4f69-462f-85e7-29743ab9d8dc</validationMethod>
          <keyLength>key_4096</keyLength>
          <ocsp>0</ocsp>
          <restartActions/>
          <autoRenewal>1</autoRenewal>
          <renewInterval>60</renewInterval>
          <aliasmode>none</aliasmode>
          <domainalias/>
          <challengealias/>
          <certRefId>6827f89ea8953</certRefId>
          <lastUpdate>1747450987</lastUpdate>
          <statusCode>200</statusCode>
          <statusLastUpdate>1747450987</statusLastUpdate>
        </certificate>
      </certificates>
      <validations>
        <validation uuid="4bd080d0-4f69-462f-85e7-29743ab9d8dc">
          <id>6827f83d158fa3.88644219</id>
          <enabled>1</enabled>
          <name>DomainOffensive_DNS-01_LE_API</name>
          <description/>
          <method>dns01</method>
          <http_service>opnsense</http_service>
          <http_opn_autodiscovery>1</http_opn_autodiscovery>
          <http_opn_interface/>
          <http_opn_ipaddresses/>
          <http_haproxyInject>1</http_haproxyInject>
          <http_haproxyFrontends/>
          <tlsalpn_service>acme</tlsalpn_service>
          <tlsalpn_acme_autodiscovery>1</tlsalpn_acme_autodiscovery>
          <tlsalpn_acme_interface/>
          <tlsalpn_acme_ipaddresses/>
          <dns_service>dns_doapi</dns_service>
          <dns_sleep>0</dns_sleep>
          <dns_active24_token/>
          <dns_ad_key/>
          <dns_ali_key/>
          <dns_ali_secret/>
          <dns_autodns_user/>
          <dns_autodns_password/>
          <dns_autodns_context/>
          <dns_aws_id/>
          <dns_aws_secret/>
          <dns_azuredns_subscriptionid/>
          <dns_azuredns_tenantid/>
          <dns_azuredns_appid/>
          <dns_azuredns_clientsecret/>
          <dns_bunny_api_key/>
          <dns_cf_email/>
          <dns_cf_key/>
          <dns_cf_token/>
          <dns_cf_account_id/>
          <dns_cf_zone_id/>
          <dns_cloudns_auth_id/>
          <dns_cloudns_sub_auth_id/>
          <dns_cloudns_auth_password/>
          <dns_cx_key/>
          <dns_cx_secret/>
          <dns_cyon_user/>
          <dns_cyon_password/>
          <dns_da_key/>
          <dns_da_insecure>1</dns_da_insecure>
          <dns_ddnss_token/>
          <dns_dgon_key/>
          <dns_dnsexit_auth_user/>
          <dns_dnsexit_auth_pass/>
          <dns_dnsexit_api/>
          <dns_dnshome_password/>
          <dns_dnshome_subdomain/>
          <dns_dnsimple_token/>
          <dns_dnsservices_user/>
          <dns_dnsservices_password/>
          <dns_doapi_token>TOKEN</dns_doapi_token>
          <dns_do_pid/>
          <dns_do_password/>
          <dns_domeneshop_token/>
          <dns_domeneshop_secret/>
          <dns_dp_id/>
          <dns_dp_key/>
          <dns_dh_key/>
          <dns_duckdns_token/>
          <dns_dyn_customer/>
          <dns_dyn_user/>
          <dns_dyn_password/>
          <dns_dynu_clientid/>
          <dns_dynu_secret/>
          <dns_freedns_user/>
          <dns_freedns_password/>
          <dns_fornex_api_key/>
          <dns_gandi_livedns_key/>
          <dns_gandi_livedns_token/>
          <dns_gcloud_key/>
          <dns_googledomains_access_token/>
          <dns_googledomains_zone/>
          <dns_gd_key/>
          <dns_gd_secret/>
          <dns_hostingde_server/>
          <dns_hostingde_apiKey/>
          <dns_he_user/>
          <dns_he_password/>
          <dns_infoblox_credentials/>
          <dns_infoblox_server/>
          <dns_inwx_user/>
          <dns_inws_password/>
          <dns_inwx_password/>
          <dns_inwx_shared_secret/>
          <dns_ionos_prefix/>
          <dns_ionos_secret/>
          <dns_ipv64_token/>
          <dns_ispconfig_user/>
          <dns_ispconfig_password/>
          <dns_ispconfig_api/>
          <dns_ispconfig_insecure>1</dns_ispconfig_insecure>
          <dns_jd_id/>
          <dns_jd_region/>
          <dns_jd_secret/>
          <dns_joker_username/>
          <dns_joker_password/>
          <dns_kinghost_username/>
          <dns_kinghost_password/>
          <dns_knot_server/>
          <dns_knot_key/>
          <dns_lexicon_provider>cloudflare</dns_lexicon_provider>
          <dns_lexicon_user/>
          <dns_lexicon_token/>
          <dns_limacity_apikey/>
          <dns_linode_key/>
          <dns_linode_v4_key/>
          <dns_loopia_api>https://api.loopia.se/RPCSERV</dns_loopia_api>
          <dns_loopia_user/>
          <dns_loopia_password/>
          <dns_lua_email/>
          <dns_lua_key/>
          <dns_miab_user/>
          <dns_miab_password/>
          <dns_miab_server/>
          <dns_me_key/>
          <dns_me_secret/>
          <dns_mydnsjp_masterid/>
          <dns_mydnsjp_password/>
          <dns_mythic_beasts_key/>
          <dns_mythic_beasts_secret/>
          <dns_namecheap_user/>
          <dns_namecheap_api/>
          <dns_namecheap_sourceip/>
          <dns_namecom_user/>
          <dns_namecom_token/>
          <dns_namesilo_key/>
          <dns_nederhost_key/>
          <dns_netcup_cid/>
          <dns_netcup_key/>
          <dns_netcup_pw/>
          <dns_njalla_token/>
          <dns_nsone_key/>
          <dns_nsupdate_server/>
          <dns_nsupdate_zone/>
          <dns_nsupdate_key/>
          <dns_oci_cli_user/>
          <dns_oci_cli_tenancy/>
          <dns_oci_cli_region/>
          <dns_oci_cli_key/>
          <dns_online_key/>
          <dns_opnsense_host>localhost</dns_opnsense_host>
          <dns_opnsense_port>443</dns_opnsense_port>
          <dns_opnsense_key/>
          <dns_opnsense_token/>
          <dns_opnsense_insecure>0</dns_opnsense_insecure>
          <dns_ovh_app_key/>
          <dns_ovh_app_secret/>
          <dns_ovh_consumer_key/>
          <dns_ovh_endpoint/>
          <dns_pleskxml_user/>
          <dns_pleskxml_pass/>
          <dns_pleskxml_uri/>
          <dns_pdns_url/>
          <dns_pdns_serverid/>
          <dns_pdns_token/>
          <dns_porkbun_key/>
          <dns_porkbun_secret/>
          <dns_sl_key/>
          <dns_selfhost_user/>
          <dns_selfhost_password/>
          <dns_selfhost_map/>
          <dns_servercow_username/>
          <dns_servercow_password/>
          <dns_simply_api_key/>
          <dns_simply_account_name/>
          <dns_transip_username/>
          <dns_transip_key/>
          <dns_udr_user/>
          <dns_udr_password/>
          <dns_uno_key/>
          <dns_uno_user/>
          <dns_vscale_key/>
          <dns_vultr_key/>
          <dns_yandex_token/>
          <dns_zilore_key/>
          <dns_zm_key/>
          <dns_gdnsdk_user/>
          <dns_gdnsdk_password/>
          <dns_acmedns_user/>
          <dns_acmedns_password/>
          <dns_acmedns_subdomain/>
          <dns_acmedns_updateurl/>
          <dns_acmedns_baseurl/>
          <dns_acmeproxy_endpoint/>
          <dns_acmeproxy_username/>
          <dns_acmeproxy_password/>
          <dns_variomedia_key/>
          <dns_schlundtech_user/>
          <dns_schlundtech_password/>
          <dns_easydns_apitoken/>
          <dns_easydns_apikey/>
          <dns_euserv_user/>
          <dns_euserv_password/>
          <dns_leaseweb_key/>
          <dns_cn_user/>
          <dns_cn_password/>
          <dns_arvan_token/>
          <dns_artfiles_username/>
          <dns_artfiles_password/>
          <dns_hetzner_token/>
          <dns_hexonet_login/>
          <dns_hexonet_password/>
          <dns_1984hosting_user/>
          <dns_1984hosting_password/>
          <dns_kas_login/>
          <dns_kas_authdata/>
          <dns_kas_authtype>plain</dns_kas_authtype>
          <dns_desec_token/>
          <dns_desec_name/>
          <dns_infomaniak_token/>
          <dns_zone_username/>
          <dns_zone_key/>
          <dns_dynv6_token/>
          <dns_cpanel_user/>
          <dns_cpanel_token/>
          <dns_cpanel_hostname/>
          <dns_regru_username/>
          <dns_regru_password/>
          <dns_nic_username/>
          <dns_nic_password/>
          <dns_nic_client/>
          <dns_nic_secret/>
          <dns_world4you_username/>
          <dns_world4you_password/>
          <dns_aurora_key/>
          <dns_aurora_secret/>
          <dns_conoha_user/>
          <dns_conoha_password/>
          <dns_conoha_tenantid/>
          <dns_conoha_idapi>https://identity.xxxx.conoha.io/v2.0</dns_conoha_idapi>
          <dns_constellix_key/>
          <dns_constellix_secret/>
          <dns_exoscale_key/>
          <dns_exoscale_secret/>
          <dns_internetbs_key/>
          <dns_internetbs_password/>
          <dns_pointhq_key/>
          <dns_pointhq_email/>
          <dns_rackspace_user/>
          <dns_rackspace_key/>
          <dns_rage4_token/>
          <dns_rage4_user/>
          <dns_scaleway_token/>
        </validation>
      </validations>
      <actions/>
    </AcmeClient>

AcmeClient logs in /var/log/acmeclient/acmeclient_20250517.log

 
acme.sh 63491 - [meta sequenceId="1"] [Sat May 17 05:03:00 CEST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
acme.sh 67248 - [meta sequenceId="2"] [Sat May 17 05:03:00 CEST 2025] Creating domain key
acme.sh 74367 - [meta sequenceId="3"] [Sat May 17 05:03:01 CEST 2025] The domain key is here: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.key
acme.sh 77755 - [meta sequenceId="4"] [Sat May 17 05:03:01 CEST 2025] Multi domain='DNS:domain.tld,DNS:*.domain.tld'
acme.sh 27005 - [meta sequenceId="5"] [Sat May 17 05:03:04 CEST 2025] Getting webroot for domain='domain.tld'
acme.sh 30436 - [meta sequenceId="6"] [Sat May 17 05:03:04 CEST 2025] Getting webroot for domain='*.domain.tld'
acme.sh 37010 - [meta sequenceId="7"] [Sat May 17 05:03:04 CEST 2025] domain.tld is already verified, skipping dns-01.
acme.sh 39064 - [meta sequenceId="8"] [Sat May 17 05:03:04 CEST 2025] *.domain.tld is already verified, skipping dns-01.
acme.sh 39926 - [meta sequenceId="9"] [Sat May 17 05:03:04 CEST 2025] Verification finished, beginning signing.
acme.sh 41333 - [meta sequenceId="10"] [Sat May 17 05:03:04 CEST 2025] Let's finalize the order.
acme.sh 41998 - [meta sequenceId="11"] [Sat May 17 05:03:04 CEST 2025] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
acme.sh 48348 - [meta sequenceId="12"] [Sat May 17 05:03:06 CEST 2025] Downloading cert.
acme.sh 48778 - [meta sequenceId="13"] [Sat May 17 05:03:06 CEST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/id'
acme.sh 55006 - [meta sequenceId="14"] [Sat May 17 05:03:06 CEST 2025] Cert success.
acme.sh 55678 - [meta sequenceId="15"] [Sat May 17 05:03:06 CEST 2025] Your cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.cer
acme.sh 56351 - [meta sequenceId="16"] [Sat May 17 05:03:06 CEST 2025] Your cert key is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.key
acme.sh 57491 - [meta sequenceId="17"] [Sat May 17 05:03:06 CEST 2025] The intermediate CA cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/ca.cer
acme.sh 58271 - [meta sequenceId="18"] [Sat May 17 05:03:06 CEST 2025] And the full-chain cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/fullchain.cer
acme.sh 64070 - [meta sequenceId="19"] [Sat May 17 05:03:06 CEST 2025] Installing cert to: /var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem
acme.sh 64765 - [meta sequenceId="20"] [Sat May 17 05:03:06 CEST 2025] Installing CA to: /var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem
acme.sh 65292 - [meta sequenceId="21"] [Sat May 17 05:03:06 CEST 2025] Installing key to: /var/etc/acme-client/keys/6827f870236dc4.05560606/private.key
acme.sh 66234 - [meta sequenceId="22"] [Sat May 17 05:03:06 CEST 2025] Installing full chain to: /var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem

AcmeClient logs in /var/log/system/system_20250517.log

 
2025-05-17T05:02:59+02:00 opnsense 48576 - [meta sequenceId="1"] AcmeClient: issue certificate: domain.tld
2025-05-17T05:02:59+02:00 opnsense 48576 - [meta sequenceId="2"] AcmeClient: using CA: letsencrypt
2025-05-17T05:02:59+02:00 opnsense 48576 - [meta sequenceId="3"] AcmeClient: account is registered: <account>
2025-05-17T05:02:59+02:00 opnsense 48576 - [meta sequenceId="4"] AcmeClient: using challenge type: DomainOffensive_DNS-01_LE_API
2025-05-17T05:03:06+02:00 opnsense 48576 - [meta sequenceId="5"] AcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --issue --syslog 6 --log-level 1 --server 'letsencrypt' --dns 'dns_doapi' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/6827f870236dc4.05560606' --certpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem' --keypath '/var/etc/acme-client/keys/6827f870236dc4.05560606/private.key' --capath '/var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem' --fullchainpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem' --domain 'domain.tld' --domain '*.domain.tld' --days '1' --force  --keylength '4096' --accountconf '/var/etc/acme-client/accounts/6827f80924bdf6.96243036_prod/account.conf''
2025-05-17T05:03:06+02:00 opnsense 48576 - [meta sequenceId="6"] AcmeClient: successfully issued/renewed certificate: domain.tld
2025-05-17T05:03:06+02:00 opnsense 48576 - [meta sequenceId="7"] AcmeClient: imported ACME CA: R10 (6827fc6aee8c0)
2025-05-17T05:03:07+02:00 config 48576 - [meta sequenceId="8"] AcmeClient: updated ACME X.509 certificate: domain.tld (6827f89ea8953)

Curverneur avatar May 17 '25 13:05 Curverneur

(1) Wait for the next daily cron run. Observe in the system log: running acme.sh command: ...

Please post the full System Log output for the renewal. (The original report only contains System Log entries for the initial cert creation, no renewal related entries.)

fraenki avatar May 19 '25 21:05 fraenki

Hi @fraenki, hope you're doing well! Thanks for your quick reply. Sorry, I forgot that part. I switched the log level to debug and renewed the certificate.

/var/log/acmeclient/acmeclient_20250519.log 
opnsense.local acme.sh 99253 - [meta sequenceId="1"] [Mon May 19 23:32:06 CEST 2025] Using server: https://acme-v02.api.letsencrypt.org/directory
opnsense.local acme.sh 20 - [meta sequenceId="2"] [Mon May 19 23:32:06 CEST 2025] Running cmd: issue
opnsense.local acme.sh 1073 - [meta sequenceId="3"] [Mon May 19 23:32:06 CEST 2025] _main_domain='domain.tld'
opnsense.local acme.sh 1779 - [meta sequenceId="4"] [Mon May 19 23:32:06 CEST 2025] _alt_domains='*.domain.tld'
opnsense.local acme.sh 2564 - [meta sequenceId="5"] [Mon May 19 23:32:06 CEST 2025] Using config home: /var/etc/acme-client/home
opnsense.local acme.sh 3263 - [meta sequenceId="6"] [Mon May 19 23:32:06 CEST 2025] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
opnsense.local acme.sh 4832 - [meta sequenceId="7"] [Mon May 19 23:32:06 CEST 2025] DOMAIN_PATH='/var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld'
opnsense.local acme.sh 6367 - [meta sequenceId="8"] [Mon May 19 23:32:06 CEST 2025] Le_NextRenewTime='1747487816'
opnsense.local acme.sh 6912 - [meta sequenceId="9"] [Mon May 19 23:32:06 CEST 2025] Using ACME_DIRECTORY: https://acme-v02.api.letsencrypt.org/directory
opnsense.local acme.sh 7534 - [meta sequenceId="10"] [Mon May 19 23:32:06 CEST 2025] _init API for server: https://acme-v02.api.letsencrypt.org/directory
opnsense.local acme.sh 8573 - [meta sequenceId="11"] [Mon May 19 23:32:06 CEST 2025] GET
opnsense.local acme.sh 9302 - [meta sequenceId="12"] [Mon May 19 23:32:06 CEST 2025] url='https://acme-v02.api.letsencrypt.org/directory'
opnsense.local acme.sh 10016 - [meta sequenceId="13"] [Mon May 19 23:32:06 CEST 2025] timeout=
opnsense.local acme.sh 11628 - [meta sequenceId="14"] [Mon May 19 23:32:06 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.epZj5mt6y6  -g '
opnsense.local acme.sh 12433 - [meta sequenceId="15"] [Mon May 19 23:32:06 CEST 2025] ret='0'
opnsense.local acme.sh 14974 - [meta sequenceId="16"] [Mon May 19 23:32:06 CEST 2025] ACME_KEY_CHANGE='https://acme-v02.api.letsencrypt.org/acme/key-change'
opnsense.local acme.sh 15668 - [meta sequenceId="17"] [Mon May 19 23:32:06 CEST 2025] ACME_NEW_AUTHZ
opnsense.local acme.sh 16292 - [meta sequenceId="18"] [Mon May 19 23:32:06 CEST 2025] ACME_NEW_ORDER='https://acme-v02.api.letsencrypt.org/acme/new-order'
opnsense.local acme.sh 16870 - [meta sequenceId="19"] [Mon May 19 23:32:06 CEST 2025] ACME_NEW_ACCOUNT='https://acme-v02.api.letsencrypt.org/acme/new-acct'
opnsense.local acme.sh 17407 - [meta sequenceId="20"] [Mon May 19 23:32:06 CEST 2025] ACME_REVOKE_CERT='https://acme-v02.api.letsencrypt.org/acme/revoke-cert'
opnsense.local acme.sh 18219 - [meta sequenceId="21"] [Mon May 19 23:32:06 CEST 2025] ACME_AGREEMENT='https://letsencrypt.org/documents/LE-SA-v1.5-February-24-2025.pdf'
opnsense.local acme.sh 18901 - [meta sequenceId="22"] [Mon May 19 23:32:06 CEST 2025] ACME_NEW_NONCE='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
opnsense.local acme.sh 25765 - [meta sequenceId="23"] [Mon May 19 23:32:06 CEST 2025] Using CA: https://acme-v02.api.letsencrypt.org/directory
opnsense.local acme.sh 26285 - [meta sequenceId="24"] [Mon May 19 23:32:06 CEST 2025] _on_before_issue
opnsense.local acme.sh 26967 - [meta sequenceId="25"] [Mon May 19 23:32:06 CEST 2025] _chk_main_domain='domain.tld'
opnsense.local acme.sh 27520 - [meta sequenceId="26"] [Mon May 19 23:32:06 CEST 2025] _chk_alt_domains='*.domain.tld'
opnsense.local acme.sh 28590 - [meta sequenceId="27"] [Mon May 19 23:32:06 CEST 2025] Le_LocalAddress
opnsense.local acme.sh 29493 - [meta sequenceId="28"] [Mon May 19 23:32:06 CEST 2025] d='domain.tld'
opnsense.local acme.sh 30218 - [meta sequenceId="29"] [Mon May 19 23:32:06 CEST 2025] Checking for domain='domain.tld'
opnsense.local acme.sh 31048 - [meta sequenceId="30"] [Mon May 19 23:32:06 CEST 2025] _currentRoot='dns_doapi'
opnsense.local acme.sh 31977 - [meta sequenceId="31"] [Mon May 19 23:32:06 CEST 2025] d='*.domain.tld'
opnsense.local acme.sh 32528 - [meta sequenceId="32"] [Mon May 19 23:32:06 CEST 2025] Checking for domain='*.domain.tld'
opnsense.local acme.sh 33777 - [meta sequenceId="33"] [Mon May 19 23:32:06 CEST 2025] _currentRoot='dns_doapi'
opnsense.local acme.sh 34742 - [meta sequenceId="34"] [Mon May 19 23:32:06 CEST 2025] d
opnsense.local acme.sh 36781 - [meta sequenceId="35"] [Mon May 19 23:32:06 CEST 2025] _saved_account_key_hash was not changed, skipping account registration.
opnsense.local acme.sh 37874 - [meta sequenceId="36"] [Mon May 19 23:32:06 CEST 2025] Read key length: 4096
opnsense.local acme.sh 38624 - [meta sequenceId="37"] [Mon May 19 23:32:06 CEST 2025] _createcsr
opnsense.local acme.sh 44405 - [meta sequenceId="38"] [Mon May 19 23:32:06 CEST 2025] Multi domain='DNS:domain.tld,DNS:*.domain.tld'
opnsense.local acme.sh 47941 - [meta sequenceId="39"] [Mon May 19 23:32:07 CEST 2025] Getting domain auth token for each domain
opnsense.local acme.sh 50435 - [meta sequenceId="40"] [Mon May 19 23:32:07 CEST 2025] d='*.domain.tld'
opnsense.local acme.sh 52871 - [meta sequenceId="41"] [Mon May 19 23:32:07 CEST 2025] d
opnsense.local acme.sh 54309 - [meta sequenceId="42"] [Mon May 19 23:32:07 CEST 2025] STEP 1, Ordering a Certificate
opnsense.local acme.sh 54962 - [meta sequenceId="43"] [Mon May 19 23:32:07 CEST 2025] =======Sending Signed Request=======
opnsense.local acme.sh 55755 - [meta sequenceId="44"] [Mon May 19 23:32:07 CEST 2025] url='https://acme-v02.api.letsencrypt.org/acme/new-order'
opnsense.local acme.sh 56408 - [meta sequenceId="45"] [Mon May 19 23:32:07 CEST 2025] payload='{"identifiers": [{"type":"dns","value":"domain.tld"},{"type":"dns","value":"*.domain.tld"}]}'
opnsense.local acme.sh 57001 - [meta sequenceId="46"] [Mon May 19 23:32:07 CEST 2025] RSA key
opnsense.local acme.sh 79821 - [meta sequenceId="47"] [Mon May 19 23:32:07 CEST 2025] HEAD
opnsense.local acme.sh 80354 - [meta sequenceId="48"] [Mon May 19 23:32:07 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-nonce'
opnsense.local acme.sh 81852 - [meta sequenceId="49"] [Mon May 19 23:32:07 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g  -I  '
opnsense.local acme.sh 82269 - [meta sequenceId="50"] [Mon May 19 23:32:08 CEST 2025] _ret='0'
opnsense.local acme.sh 85533 - [meta sequenceId="51"] [Mon May 19 23:32:08 CEST 2025] POST
opnsense.local acme.sh 86345 - [meta sequenceId="52"] [Mon May 19 23:32:08 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/new-order'
opnsense.local acme.sh 87423 - [meta sequenceId="53"] [Mon May 19 23:32:08 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g '
opnsense.local acme.sh 88270 - [meta sequenceId="54"] [Mon May 19 23:32:08 CEST 2025] _ret='0'
opnsense.local acme.sh 89923 - [meta sequenceId="55"] [Mon May 19 23:32:08 CEST 2025] code='201'
opnsense.local acme.sh 93443 - [meta sequenceId="56"] [Mon May 19 23:32:08 CEST 2025] Le_LinkOrder='https://acme-v02.api.letsencrypt.org/acme/order/id/id'
opnsense.local acme.sh 94504 - [meta sequenceId="57"] [Mon May 19 23:32:08 CEST 2025] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
opnsense.local acme.sh 96683 - [meta sequenceId="58"] [Mon May 19 23:32:08 CEST 2025] STEP 2, Get the authorizations of each domain
opnsense.local acme.sh 97862 - [meta sequenceId="59"] [Mon May 19 23:32:08 CEST 2025] =======Sending Signed Request=======
opnsense.local acme.sh 98514 - [meta sequenceId="60"] [Mon May 19 23:32:08 CEST 2025] url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 99052 - [meta sequenceId="61"] [Mon May 19 23:32:08 CEST 2025] payload
opnsense.local acme.sh 3019 - [meta sequenceId="62"] [Mon May 19 23:32:08 CEST 2025] POST
opnsense.local acme.sh 3622 - [meta sequenceId="63"] [Mon May 19 23:32:08 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 5255 - [meta sequenceId="64"] [Mon May 19 23:32:08 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g '
opnsense.local acme.sh 5959 - [meta sequenceId="65"] [Mon May 19 23:32:09 CEST 2025] _ret='0'
opnsense.local acme.sh 7571 - [meta sequenceId="66"] [Mon May 19 23:32:09 CEST 2025] code='200'
opnsense.local acme.sh 11728 - [meta sequenceId="67"] [Mon May 19 23:32:09 CEST 2025] =======Sending Signed Request=======
opnsense.local acme.sh 12397 - [meta sequenceId="68"] [Mon May 19 23:32:09 CEST 2025] url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 13086 - [meta sequenceId="69"] [Mon May 19 23:32:09 CEST 2025] payload
opnsense.local acme.sh 16508 - [meta sequenceId="70"] [Mon May 19 23:32:09 CEST 2025] POST
opnsense.local acme.sh 16984 - [meta sequenceId="71"] [Mon May 19 23:32:09 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 17944 - [meta sequenceId="72"] [Mon May 19 23:32:09 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g '
opnsense.local acme.sh 18938 - [meta sequenceId="73"] [Mon May 19 23:32:09 CEST 2025] _ret='0'
opnsense.local acme.sh 20494 - [meta sequenceId="74"] [Mon May 19 23:32:09 CEST 2025] code='200'
opnsense.local acme.sh 25375 - [meta sequenceId="75"] [Mon May 19 23:32:09 CEST 2025] d='domain.tld'
opnsense.local acme.sh 26082 - [meta sequenceId="76"] [Mon May 19 23:32:09 CEST 2025] Getting webroot for domain='domain.tld'
opnsense.local acme.sh 26989 - [meta sequenceId="77"] [Mon May 19 23:32:09 CEST 2025] _w='dns_doapi'
opnsense.local acme.sh 27497 - [meta sequenceId="78"] [Mon May 19 23:32:09 CEST 2025] _currentRoot='dns_doapi'
opnsense.local acme.sh 30432 - [meta sequenceId="79"] [Mon May 19 23:32:09 CEST 2025] _authz_url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 31529 - [meta sequenceId="80"] [Mon May 19 23:32:09 CEST 2025] domain.tld is already valid.
opnsense.local acme.sh 32192 - [meta sequenceId="81"] [Mon May 19 23:32:09 CEST 2025] keyauthorization='verified_ok'
opnsense.local acme.sh 33132 - [meta sequenceId="82"] [Mon May 19 23:32:09 CEST 2025] entry='"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/id/id/mxnJpA","status":"valid","validated":"2025-05-17T02:46:43Z","token":"TOKEN","validationRecord":[{"hostname":"domain.tld"'
opnsense.local acme.sh 33759 - [meta sequenceId="83"] [Mon May 19 23:32:09 CEST 2025] dvlist='domain.tld#verified_ok##dns-01#dns_doapi#https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 34671 - [meta sequenceId="84"] [Mon May 19 23:32:09 CEST 2025] d='*.domain.tld'
opnsense.local acme.sh 35383 - [meta sequenceId="85"] [Mon May 19 23:32:09 CEST 2025] Getting webroot for domain='*.domain.tld'
opnsense.local acme.sh 36007 - [meta sequenceId="86"] [Mon May 19 23:32:09 CEST 2025] _w='dns_doapi'
opnsense.local acme.sh 36829 - [meta sequenceId="87"] [Mon May 19 23:32:09 CEST 2025] _currentRoot='dns_doapi'
opnsense.local acme.sh 40258 - [meta sequenceId="88"] [Mon May 19 23:32:09 CEST 2025] _authz_url='https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 40963 - [meta sequenceId="89"] [Mon May 19 23:32:09 CEST 2025] *.domain.tld is already valid.
opnsense.local acme.sh 41419 - [meta sequenceId="90"] [Mon May 19 23:32:09 CEST 2025] keyauthorization='verified_ok'
opnsense.local acme.sh 42077 - [meta sequenceId="91"] [Mon May 19 23:32:09 CEST 2025] entry='"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/id/id/fbWZFfb","status":"valid","validated":"2025-05-17T02:46:46Z","token":"TOKEN","validationRecord":[{"hostname":"domain.tld"'
opnsense.local acme.sh 42633 - [meta sequenceId="92"] [Mon May 19 23:32:09 CEST 2025] dvlist='*.domain.tld#verified_ok##dns-01#dns_doapi#https://acme-v02.api.letsencrypt.org/acme/authz/id/id'
opnsense.local acme.sh 43508 - [meta sequenceId="93"] [Mon May 19 23:32:10 CEST 2025] d
opnsense.local acme.sh 44219 - [meta sequenceId="94"] [Mon May 19 23:32:10 CEST 2025] vlist='domain.tld#verified_ok##dns-01#dns_doapi#https://acme-v02.api.letsencrypt.org/acme/authz/id/id,*.domain.tld#verified_ok##dns-01#dns_doapi#https://acme-v02.api.letsencrypt.org/acme/authz/id/id,'
opnsense.local acme.sh 46806 - [meta sequenceId="95"] [Mon May 19 23:32:10 CEST 2025] d='domain.tld'
opnsense.local acme.sh 47486 - [meta sequenceId="96"] [Mon May 19 23:32:10 CEST 2025] domain.tld has already been verified, skipping dns-01.
opnsense.local acme.sh 49343 - [meta sequenceId="97"] [Mon May 19 23:32:10 CEST 2025] d='*.domain.tld'
opnsense.local acme.sh 49974 - [meta sequenceId="98"] [Mon May 19 23:32:10 CEST 2025] *.domain.tld has already been verified, skipping dns-01.
opnsense.local acme.sh 50584 - [meta sequenceId="99"] [Mon May 19 23:32:10 CEST 2025] OK, let's start verification
opnsense.local acme.sh 52802 - [meta sequenceId="100"] [Mon May 19 23:32:10 CEST 2025] domain.tld is already verified, skipping dns-01.
opnsense.local acme.sh 54699 - [meta sequenceId="101"] [Mon May 19 23:32:10 CEST 2025] *.domain.tld is already verified, skipping dns-01.
opnsense.local acme.sh 55143 - [meta sequenceId="102"] [Mon May 19 23:32:10 CEST 2025] pid
opnsense.local acme.sh 55756 - [meta sequenceId="103"] [Mon May 19 23:32:10 CEST 2025] No need to restore nginx config, skipping.
opnsense.local acme.sh 56253 - [meta sequenceId="104"] [Mon May 19 23:32:10 CEST 2025] _clearupdns
opnsense.local acme.sh 56979 - [meta sequenceId="105"] [Mon May 19 23:32:10 CEST 2025] dns_entries
opnsense.local acme.sh 57598 - [meta sequenceId="106"] [Mon May 19 23:32:10 CEST 2025] Skipping dns.
opnsense.local acme.sh 58087 - [meta sequenceId="107"] [Mon May 19 23:32:10 CEST 2025] Verification finished, beginning signing.
opnsense.local acme.sh 59601 - [meta sequenceId="108"] [Mon May 19 23:32:10 CEST 2025] i='2'
opnsense.local acme.sh 60306 - [meta sequenceId="109"] [Mon May 19 23:32:10 CEST 2025] j='26'
opnsense.local acme.sh 61041 - [meta sequenceId="110"] [Mon May 19 23:32:10 CEST 2025] Let's finalize the order.
opnsense.local acme.sh 61652 - [meta sequenceId="111"] [Mon May 19 23:32:10 CEST 2025] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
opnsense.local acme.sh 62272 - [meta sequenceId="112"] [Mon May 19 23:32:10 CEST 2025] =======Sending Signed Request=======
opnsense.local acme.sh 62906 - [meta sequenceId="113"] [Mon May 19 23:32:10 CEST 2025] url='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
opnsense.local acme.sh 63630 - [meta sequenceId="114"] [Mon May 19 23:32:10 CEST 2025] payload='{"csr": "CSR"}'
opnsense.local acme.sh 67328 - [meta sequenceId="115"] [Mon May 19 23:32:10 CEST 2025] POST
opnsense.local acme.sh 67886 - [meta sequenceId="116"] [Mon May 19 23:32:10 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/finalize/id/id'
opnsense.local acme.sh 69072 - [meta sequenceId="117"] [Mon May 19 23:32:10 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g '
opnsense.local acme.sh 69690 - [meta sequenceId="118"] [Mon May 19 23:32:14 CEST 2025] _ret='0'
opnsense.local acme.sh 71703 - [meta sequenceId="119"] [Mon May 19 23:32:14 CEST 2025] code='200'
opnsense.local acme.sh 75238 - [meta sequenceId="120"] [Mon May 19 23:32:14 CEST 2025] Order status is valid.
opnsense.local acme.sh 76052 - [meta sequenceId="121"] [Mon May 19 23:32:14 CEST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/id'
opnsense.local acme.sh 76491 - [meta sequenceId="122"] [Mon May 19 23:32:14 CEST 2025] Downloading cert.
opnsense.local acme.sh 76864 - [meta sequenceId="123"] [Mon May 19 23:32:14 CEST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/id'
opnsense.local acme.sh 77362 - [meta sequenceId="124"] [Mon May 19 23:32:14 CEST 2025] =======Sending Signed Request=======
opnsense.local acme.sh 77890 - [meta sequenceId="125"] [Mon May 19 23:32:14 CEST 2025] url='https://acme-v02.api.letsencrypt.org/acme/cert/id'
opnsense.local acme.sh 78659 - [meta sequenceId="126"] [Mon May 19 23:32:14 CEST 2025] payload
opnsense.local acme.sh 82230 - [meta sequenceId="127"] [Mon May 19 23:32:14 CEST 2025] POST
opnsense.local acme.sh 82829 - [meta sequenceId="128"] [Mon May 19 23:32:14 CEST 2025] _post_url='https://acme-v02.api.letsencrypt.org/acme/cert/id'
opnsense.local acme.sh 83676 - [meta sequenceId="129"] [Mon May 19 23:32:14 CEST 2025] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header  -L  --trace-ascii /tmp/tmp.lqiddPevuq  -g '
opnsense.local acme.sh 84251 - [meta sequenceId="130"] [Mon May 19 23:32:14 CEST 2025] _ret='0'
opnsense.local acme.sh 85689 - [meta sequenceId="131"] [Mon May 19 23:32:14 CEST 2025] code='200'
opnsense.local acme.sh 87933 - [meta sequenceId="132"] [Mon May 19 23:32:14 CEST 2025] Found cert chain
opnsense.local acme.sh 88982 - [meta sequenceId="133"] [Mon May 19 23:32:14 CEST 2025] _end_n='34'
opnsense.local acme.sh 89808 - [meta sequenceId="134"] [Mon May 19 23:32:14 CEST 2025] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/id'
opnsense.local acme.sh 91438 - [meta sequenceId="135"] [Mon May 19 23:32:14 CEST 2025] Cert success.
opnsense.local acme.sh 92086 - [meta sequenceId="136"] [Mon May 19 23:32:14 CEST 2025] Your cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.cer
opnsense.local acme.sh 92835 - [meta sequenceId="137"] [Mon May 19 23:32:14 CEST 2025] Your cert key is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/domain.tld.key
opnsense.local acme.sh 94492 - [meta sequenceId="138"] [Mon May 19 23:32:14 CEST 2025] The intermediate CA cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/ca.cer
opnsense.local acme.sh 95072 - [meta sequenceId="139"] [Mon May 19 23:32:14 CEST 2025] And the full-chain cert is in: /var/etc/acme-client/cert-home/6827f870236dc4.05560606/domain.tld/fullchain.cer
opnsense.local acme.sh 6431 - [meta sequenceId="140"] [Mon May 19 23:32:14 CEST 2025] Installing cert to: /var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem
opnsense.local acme.sh 7159 - [meta sequenceId="141"] [Mon May 19 23:32:14 CEST 2025] Installing CA to: /var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem
opnsense.local acme.sh 7789 - [meta sequenceId="142"] [Mon May 19 23:32:14 CEST 2025] Installing key to: /var/etc/acme-client/keys/6827f870236dc4.05560606/private.key
opnsense.local acme.sh 8455 - [meta sequenceId="143"] [Mon May 19 23:32:14 CEST 2025] Installing full chain to: /var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem
opnsense.local acme.sh 9058 - [meta sequenceId="144"] [Mon May 19 23:32:14 CEST 2025] _on_issue_success
/var/log/acmeclient/acmeclient_20250519.log 
opnsense.local opnsense 91453 - [meta sequenceId="1"] AcmeClient: issue certificate: domain.tld
opnsense.local opnsense 91453 - [meta sequenceId="2"] AcmeClient: using CA: letsencrypt
opnsense.local opnsense 91453 - [meta sequenceId="3"] AcmeClient: account is registered: <account>
opnsense.local opnsense 91453 - [meta sequenceId="4"] AcmeClient: using challenge type: DomainOffensive_DNS-01_LE_API
opnsense.local opnsense 91453 - [meta sequenceId="5"] AcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --issue --syslog 7 --debug --server 'letsencrypt' --dns 'dns_doapi' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/6827f870236dc4.05560606' --certpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem' --keypath '/var/etc/acme-client/keys/6827f870236dc4.05560606/private.key' --capath '/var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem' --fullchainpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem' --domain 'domain.tld' --domain '*.domain.tld' --days '1' --force  --keylength '4096' --accountconf '/var/etc/acme-client/accounts/6827f80924bdf6.96243036_prod/account.conf'
opnsense.local opnsense 91453 - [meta sequenceId="6"] AcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --issue --syslog 7 --debug --server 'letsencrypt' --dns 'dns_doapi' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/6827f870236dc4.05560606' --certpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/cert.pem' --keypath '/var/etc/acme-client/keys/6827f870236dc4.05560606/private.key' --capath '/var/etc/acme-client/certs/6827f870236dc4.05560606/chain.pem' --fullchainpath '/var/etc/acme-client/certs/6827f870236dc4.05560606/fullchain.pem' --domain 'domain.tld' --domain '*.domain.tld' --days '1' --force  --keylength '4096' --accountconf '/var/etc/acme-client/accounts/6827f80924bdf6.96243036_prod/account.conf''
opnsense.local opnsense 91453 - [meta sequenceId="7"] AcmeClient: successfully issued/renewed certificate: domain.tld
opnsense.local config 91453 - [meta sequenceId="8"] AcmeClient: updated ACME X.509 certificate: domain.tld (6827f89ea8953)

Curverneur avatar May 19 '25 22:05 Curverneur

I am also seeing this issue in my logs after investigating cert renewal notices from Let's Encrypt

System: Log Files: General
`AcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --issue --syslog 6 --log-level 1 --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/67aacdd6067f82.37269504' --certpath '/var/etc/acme-client/certs/67aacdd6067f82.37269504/cert.pem' --keypath '/var/etc/acme-client/keys/67aacdd6067f82.37269504/private.key' --capath '/var/etc/acme-client/certs/67aacdd6067f82.37269504/chain.pem' --fullchainpath '/var/etc/acme-client/certs/67aacdd6067f82.37269504/fullchain.pem' --domain '*.local.{Redacted Domian}' --days '1' --force --keylength '4096' --accountconf '/var/etc/acme-client/accounts/67aacc10970a91.54027397_prod/account.conf''`

matthewschroer avatar May 30 '25 15:05 matthewschroer

I can confirm that acme.sh is incorrectly called with --days '1'. However, this is not an issue, because the underlying code ensures that the certificate is properly renewed (e.g. not too soon and not too late). It will be fixed in the next release nonetheless.

So this does not explain why Acme Client never automatically renews the certificate. The only advice I can give you is to double-check the Update Schedule (Services: ACME Client: Settings).

fraenki avatar Jun 16 '25 15:06 fraenki

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.

OPNsense-bot avatar Nov 13 '25 13:11 OPNsense-bot