truenas-scale-acme obtains and manages certificates for TrueNAS Scale using the ACME DNS-01 challenge and the TrueNAS WebSocket API.
It uses Caddy's caddyserver/certmagic library internally to obtain and renew SSL certificates and ensures that TrueNAS uses a valid certificate to serve requests.
Currently the following providers are supported:
If you require a different provider, feel free to create an issue. In theory, all github.com/libdns providers can be supported.
The recommended way to run truenas-scale-acme is as a custom application inside TrueNAS:
Deploy via Apps → Custom App using the following compose configuration. Adjust the volume paths, schedule, user/group, and timezone to match your setup.
services:
truenas-scale-acme:
image: ghcr.io/thde/truenas-scale-acme:latest
command:
- '--daemon'
- '--schedule'
- '11 11 * * *'
- '--config'
- /etc/truenas-scale-acme/config.json
environment:
TZ: Europe/Zurich
XDG_DATA_HOME: /var
user: '3001:3001'
group_add:
- 568 # apps group
restart: on-failure:10
pull_policy: always
volumes:
- type: bind
source: /mnt/flash/home/acme/config.json
target: /etc/truenas-scale-acme/config.json
read_only: true
- type: bind
source: /mnt/flash/home/acme/certificates
target: /var/truenas-scale-acme- Create an API key in TrueNAS.
- Register an account on an ACME-DNS server:
curl -X POST https://auth.acme-dns.io/register
- Create a DNS CNAME record pointing
_acme-challenge.your-domain.example.comto thefulldomainfrom the registration response. - Create the config file at the path referenced in your compose volume (e.g.
/mnt/flash/home/acme/config.json):{ "domain": "nas.domain.com", "api": { "api_key": "s3cure", "url": "wss://172.16.0.1/api/current", "skip_verify": true }, "acme": { "email": "myemail@example.com", "tos_agreed": true, "acme-dns": { "username": "00000000-0000-0000-0000-000000000000", "password": "s3cure", "subdomain": "FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF", "server_url": "https://auth.acme-dns.io" } } } - Deploy the custom app and verify in the container logs that the certificate is issued and applied successfully.
truenas-scale-acme currently has the following CA's configured by default:
- Let's Encrypt
- ZeroSSL
This ensures a valid certificate even if one CA is unavailable.
- TrueNAS SCALE/ACME Certificates - TrueNAS Scale integrated ACME functionality using DNS authentication. Includes support for external shell commands.
- danb35/deploy-freenas - Python script to deploy TLS certificates to a TrueNAS Core using its API.
- acmesh-official/acme.sh/deploy/truenas.sh - acme.sh deploy script for TrueNAS Core using its API.