ACME / Let's Encrypt Certificates¶

Eight.ly OS has built-in ACME certificate management for automatic TLS certificates from Let's Encrypt. It's a dashboard front-end over certbot — Eight.ly drives certbot on the host (via sudo) to request, renew, and revoke certificates, so you manage them from the UI instead of the command line. certbot must be installed and reachable via sudo for this to work — if a certificate request fails outright, check that it's installed.

Where to find it: Infrastructure > Datacenter > ACME

Challenge types¶

HTTP-01¶

The simplest method. Let's Encrypt verifies you own the domain by making an HTTP request to your server on port 80.

Requirements: - Port 80 must be open and reachable from the internet - DNS must point to your server's public IP - Works for single domains only (no wildcards)

DNS-01¶

Proves domain ownership by creating a DNS TXT record. Works behind firewalls, supports wildcard certificates.

Supported DNS providers:

Only Cloudflare DNS-01 is implemented today (via certbot's dns-cloudflare plugin).

Setup¶

1. Configure a DNS plugin (for DNS-01)¶

1. Go to ACME > Plugins
2. Click Add Plugin
3. Select Cloudflare (the only DNS provider currently supported)
4. Enter your Cloudflare API token (needs Zone:DNS:Edit)
5. Save

Your token is written to /etc/letsencrypt/cloudflare.ini (mode 0600) on the server and used only to create/delete the DNS TXT record during certificate challenges.

2. Request a certificate¶

1. Go to ACME > Certificates
2. Click Add Certificate
3. Enter the domain(s) — for wildcards, use *.yourdomain.com
4. Select the challenge type (HTTP-01 or DNS-01)
5. If DNS-01, select the plugin you configured
6. Click Create

The certificate is requested from Let's Encrypt and installed automatically.

3. Auto-renewal¶

Certificates auto-renew before expiry. Renewal is handled by certbot's own systemd timer (installed with certbot), not an in-app scheduler — the timer runs certbot renew twice daily and renews any certificate with less than 30 days remaining. You can also force a renewal from the dashboard (see below), which runs certbot renew for that certificate immediately.

Managing certificates¶

From the Certificates tab:

• View — see domain, expiry date, issuer
• Renew — force an immediate renewal
• Delete — remove the certificate

When to use this vs Traefik¶

The built-in ACME is ideal for securing the Eight.ly dashboard and VM consoles. For per-app SSL with automatic routing, use Traefik.