How to Automatically Deploy SSL Certificates to Proxmox on OPNsense with ACME Client

Learn how to automatically deploy SSL certificates to Proxmox using the ACME client on OPNsense. A step-by-step guide with automation tips for seamless certificate management. This guide assumes that you have already installed and set up the ACME plugin on OPNsense.

Follow the tutorial below if you have not yet installed and set up the ACME plugin on OPNsense

Create Let’s Encrypt Wildcard Certificates on OPNsense with ACME Client

---

Here is the video version of this written tutorial:

---

Step 1: Create an API User in Proxmox

To allow OPNsense to push certificates to Proxmox, we need to create an API user with limited permissions.

1.1 Create a Proxmox API User

1. Log in to your Proxmox Web UI.
2. Navigate to Datacenter → Permissions → Users.
3. Click Add and enter:
   • User name: acme-api
   • Realm: Proxmox VE authentication server
   • Create and confirm the password
   • Expire: (Optional) Set an expiration date if needed.

1.2 Create Acme-API-only role

1. Navigate to Datacenter → pve
2. Open Shell
3. Enter the following command:
   • pveum role add AcmeAPI-only --privs "Sys.Modify"
4. Close Shell

1.3 Assign Sys.Modify Permission to the User

1. Navigate to Datacenter → Permissions
2. Click Add, select User Permission, and configure:
   • Path: /nodes/pve
   • User: acme-api@pve
   • Role: Acme-API-only
   • Propagation: Checked
3. Click Add to save.

1.4 Assign API Token to the User

1. Go to Datacenter → Permissions → API Tokens.
2. Click Add and select:
   • User: acme-api@pve
   • Token ID: acme-token
   • Privilege separation: Disabled (unchecked)
3. Copy the generated API token secret, as you won’t be able to retrieve it again.

---

Step 2: Configure ACME Client on OPNsense

With the Proxmox API user created, we can configure the ACME plugin to automatically deploy certificates.

2.1 Add a Proxmox Automation Task

1. Navigate to Services → ACME Client → Automations.
2. Click Add and configure:
   • Name: Proxmox Certificate Deployment
   • Description: Automate certificate deployment to Proxmox
   • Run Command: Upload certificate to Proxmox VE
   • Promox VE user: acme-api
   • Proxmox VE server: pve.yourdomain.com
   • Proxmox VE server port: 8006 (default)
   • Proxmox VE node name: pve
   • Proxmox VE realm: pve
   • Proxmox VE token name: acme-token
   • Proxmox VE token key: copy and paste from step 1.4.

2.2 Set Automation to Run After Certificate Renewal

1. Go to ACME Client → Certificates.
2. Edit your Let’s Encrypt certificate.
3. Under Automations, select the Proxmox Certificate Deployment automation.
4. Save.

2.3 Run Automation to deploy certificates to Promox

1. Go to ACME Client → Certificates.
2. Click the icon Run automation under the Command tab

---

Conclusion

Automating SSL certificate deployment to Proxmox using the ACME client on OPNsense simplifies security management, ensuring your hypervisor stays protected without manual intervention. By following this guide, you’ve successfully configured OPNsense to issue, renew, and push SSL certificates directly to Proxmox, reducing downtime and improving system security.

For more tutorials on networking, cybersecurity, and automation, stay tuned to SysAdmin102! If you found this guide helpful, share it with your fellow sysadmins and homelab enthusiasts.

🔹 Got questions or feedback? Drop a comment on our Facebook Page or YouTube!
🔹 Want more automation tips? Follow #SysAdmin102 on social media!

#Proxmox #OPNsense #ACMEClient #SSLAutomation #LetsEncrypt #Homelab #SysAdmin #Networking #Cybersecurity 🚀

---

💙 Want to support my channel? Check out ways to help here:

Ways to support my channel

Your support helps keep valuable tech content coming! 🚀