Support custom ACME providers

[NiccoMlt]

Implementation

Certificates can now be issued by any RFC 8555 compliant CA, not just Let's Encrypt.

Closes #536. Stacked on #619 so merge that first.

Caution

CI mocks the ACME boundary, so external account binding and custom directory URLs are not exercised end-to-end; QA will verify against a real provider. A local run against Pebble) is a meaningful smoke check.

Configuration

Providers are configured with a new configuration family and referenced per certificate:

acme.1.name=digicert
acme.1.url=https://acme.digicert.com/v2/acme/directory
# external account binding credentials (both or neither), as provided by the CA
acme.1.kid=your-key-identifier
acme.1.hmac=your-base64-encoded-hmac-key

certificate.3.hostname=myhostname.example.com
certificate.3.mode=acme
certificate.3.provider=digicert

If no provider is specified, Let's Encrypt is used, as before. Therefore, the letsencrypt name is reserved for the built-in provider.

kid and hmac are optional, but both-or-neither; those allow logging in with EAB (External Account Binding) credentials, if required by the provider.

Built-in letsencrypt provider still stores the account key under the legacy _acmeuserkey entry, while custom providers use _acmeuserkey_<name>, e.g. _acmeuserkey_digicert.

Important

carapace.acme.testmode JVM system property keeps affecting only the built-in Let's Encrypt provider (staging vs production); custom providers always use their configured URL.

REST APIs

• POST /api/certificates accepts provider too.
• POST /api/certificates/{domain}/upload accepts provider query param too (ACME type only);
• GET /api/certificates exposes each certificate's provider
  • it also exposes acmeProviders, that feeds the UI select.

Web UI

• added provider select in the certificate creation form;
• added provider column in the list;
• added provider row in the detail view.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d092e690-5ceb-4bc5-a28d-14c215a62a47

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}