Hi there.
I have installed and up and running the ACME plugin on the OPNSense community edition for some years. It refreshes a certificate for a webserver that has no external access (rocket chat) and copies it via SFTP to that system, then does a few file operations to get it installed. I used the HTTP Challenge.
Earlier this year I replaced the appliance with a new one, and wen to OPNSense business edition 25.10. That did not seem to be a problem at the time, basically everthing worked fine. Later then, it upgraded to 26.4..
*However* I noticed as of today, a couple of months later, that the certificates did not get renewed. Now, my memory is probably not the best, but I am kind of 80% sure that I checked after switching to the new appliance if the certificate was updated and believe to remember it did.
When I checked the firewall rules, I found that port 80 was not open (anymore?) at the external interfaces.
Long story short, I do not get the certificates refreshed.
I tried HTTP and TLS challenge and opening the ports, then the protocol say:
HTTP challenge:
2026-07-16T12:00:36 opnsense-business
AcmeClient: AcmeClient: The shell command returned exit code '1': '/usr/local/sbin/acme.sh --issue --syslog 6 --log-level 2 --server 'letsencrypt' --webroot /var/etc/acme-client/challenges --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/616731d690b683.11437695' --certpath '/var/etc/acme-client/certs/616731d690b683.11437695/cert.pem' --keypath '/var/etc/acme-client/keys/616731d690b683.11437695/private.key' --capath '/var/etc/acme-client/certs/616731d690b683.11437695/chain.pem' --fullchainpath '/var/etc/acme-client/certs/616731d690b683.11437695/fullchain.pem' --domain 'rocket.brace.de' --days '30' --force --keylength '4096' --accountconf '/var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf''
When using the TLS Challenge:
2026-07-16T12:01:06
opnsense-business
AcmeClient: AcmeClient: The shell command returned exit code '1': '/usr/local/sbin/acme.sh --issue --syslog 6 --log-level 2 --server 'letsencrypt' --alpn --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/616731d690b683.11437695' --certpath '/var/etc/acme-client/certs/616731d690b683.11437695/cert.pem' --keypath '/var/etc/acme-client/keys/616731d690b683.11437695/private.key' --capath '/var/etc/acme-client/certs/616731d690b683.11437695/chain.pem' --fullchainpath '/var/etc/acme-client/certs/616731d690b683.11437695/fullchain.pem' --domain 'rocket.brace.de' --days '30' --force --keylength '4096' --tlsport '43581' --accountconf '/var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf''
Under "Accounts" it claims the account is "OK" in the status.
I was not able to find a HOWTO for setting up the DNS-01 challenge (all of them omit how to create the nsupdate key and which exact format I need to put it into the DNS TXT records) so I gave up on that. If anybody has a howto for an idiot like me to get it created and installed I'll be greatful and will try.
In the ACME Log of OPNSense however, it seem to be working all well:
2026-07-16T12:00:35 acme.sh
[Thu Jul 16 12:00:35 CEST 2026] Single domain='rocket.brace.de'
2026-07-16T12:00:35 acme.sh
[Thu Jul 16 12:00:35 CEST 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Installing full chain to: /var/etc/acme-client/certs/616731d690b683.11437695/fullchain.pem
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Installing key to: /var/etc/acme-client/keys/616731d690b683.11437695/private.key
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Installing CA to: /var/etc/acme-client/certs/616731d690b683.11437695/chain.pem
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Installing cert to: /var/etc/acme-client/certs/616731d690b683.11437695/cert.pem
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] And the full-chain cert is in: /var/etc/acme-client/cert-home/616731d690b683.11437695/rocket.brace.de/fullchain.cer
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] The intermediate CA cert is in: /var/etc/acme-client/cert-home/616731d690b683.11437695/rocket.brace.de/ca.cer
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Your cert key is in: /var/etc/acme-client/cert-home/616731d690b683.11437695/rocket.brace.de/rocket.brace.de.key
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Your cert is in: /var/etc/acme-client/cert-home/616731d690b683.11437695/rocket.brace.de/rocket.brace.de.cer
2026-07-16T11:50:30 acme.sh
[Thu Jul 16 11:50:30 CEST 2026] Cert success.
2026-07-16T11:50:29 acme.sh
[Thu Jul 16 11:50:29 CEST 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/0517aa711b64efc1671ef56cccab97cf1583'
2026-07-16T11:50:29 acme.sh
[Thu Jul 16 11:50:29 CEST 2026] Downloading cert.
2026-07-16T11:50:28 acme.sh
[Thu Jul 16 11:50:28 CEST 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/3539327496/532898622926'
2026-07-16T11:50:28 acme.sh
[Thu Jul 16 11:50:28 CEST 2026] Let's finalize the order.
2026-07-16T11:50:28 acme.sh
[Thu Jul 16 11:50:28 CEST 2026] Verification finished, beginning signing.
2026-07-16T11:50:28 acme.sh
[Thu Jul 16 11:50:28 CEST 2026] rocket.brace.de is already verified, skipping http-01.
2026-07-16T11:50:28 acme.sh
[Thu Jul 16 11:50:28 CEST 2026] Getting webroot for domain='rocket.brace.de'
2026-07-16T11:50:26 acme.sh
[Thu Jul 16 11:50:26 CEST 2026] Single domain='rocket.brace.de'
Shouldn't that say that the certificate was in fact renewed and should be on OPNSense? However, in the certificate section it is displayed as "überprüfung fehlgeschlagen" (renewal failed or to whatever this is translated)
Is there anything I can do to fix that?
Thanks.
Did you do the "Reset ACME client" thing after moving to the new appliance?
BTW, thanks for the reminder - I just did a new installation of 26.7 and imported my config, but I hadn't remembered this ACME reset step ;)
Follow Up: I asked some AI and it mentioned to issue the "faulty" command directly on the firefwall, which i did.
Now, it throws a couple of errormessages
ouch: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
chmod: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot open /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot create /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
touch: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
chmod: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot open /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot create /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/5eda4b1803af18.28646449_prod/account.conf: No such file or directory
It seems as the account directory is not existing at all.
If I switch the the "Testing" account at let's encrypt the acme.sh comand is successfully running (via TLS challenge even)
2026-07-16T12:32:29
opnsense-business
AcmeClient: AcmeClient: The shell command returned exit code '0': '/usr/local/sbin/acme.sh --issue --syslog 6 --log-level 2 --server 'letsencrypt_test' --alpn --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/616731d690b683.11437695' --certpath '/var/etc/acme-client/certs/616731d690b683.11437695/cert.pem' --keypath '/var/etc/acme-client/keys/616731d690b683.11437695/private.key' --capath '/var/etc/acme-client/certs/616731d690b683.11437695/chain.pem' --fullchainpath '/var/etc/acme-client/certs/616731d690b683.11437695/fullchain.pem' --domain 'rocket.brace.de' --days '30' --force --keylength '4096' --tlsport '43581' --accountconf '/var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf''
BUT if I start it on the command line, I get the same error messages about the missing account:
touch: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
chmod: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot open /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot create /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
touch: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
chmod: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot open /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
/usr/local/sbin/acme.sh: cannot create /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
grep: /var/etc/acme-client/accounts/627608ae6954b6.64573180_stg/account.conf: No such file or directory
Just my thinking: is it possible that during migration from the community edition to the business edition everything BUT the accounts have been imported?
Quote from: dseven on Today at 12:29:34 PMDid you do the "Reset ACME client" thing after moving to the new appliance?
BTW, thanks for the reminder - I just did a new installation of 26.7 and imported my config, but I hadn't remembered this ACME reset step ;)
I most definetly did not... and I am not sure how to do it? I will look for a suitable button but if you have a hint...
Current status (sorry for that but sometimes posting my problems here starts a new though process and I retry) is that it seems that the account have not been migrated. So no account information available.
I could just click at the "register account" button besides the accounts and they seem to have been recreated in the file system.
When running the command now at the command line there seem to be no error messages anymore. Unfortunately I cleverly used the "normal" account for the inital testing and Let's Encrypt is now pretty strict, locking me out for 7 days to renew the "real" certificate.
So @dseven I believe it would at this stage not a good anymore the reset. I have to recheck in 7 days if the certificate is really renewed, and then I might come back to that issue.
Thank you.
Here...