TrueNAS SCALETrueNAS SCALE Nightly Development Documentation
This content follows experimental early release software. Use the Product and Version selectors above to view content specific to a stable software release.

Creating ACME Certificates

TrueNAS SCALE allows users to automatically generate custom domain certificates using Let’s Encrypt.

Requirements

  • An email address for your TrueNAS SCALE admin user.
  • A custom domain that uses Cloudflare, AWS Route 53, or OVH.
  • A DNS server that does not cache for your TrueNAS SCALE system.

Create an ACME DNS-Authenticator

Go to Credentials > Certificates and click ADD in the ACME DNS-Authenticators widget.

LetsEncryptAcmeDNSAuthenticator

Enter the required fields depending on your provider, then click Save.

For Cloudflare, enter either your Cloudflare Email and API Key, or enter an API Token. If you create an API Token, make sure to give the token the permission Zone.DNS:Edit as it’s required by certbot.

For Route53, enter your Access Key ID and Secret Access Key.

For OVH, enter your OVH Application Key, OVH Application Secret, OVH Consumer Key, and OVH Endpoint.

Create a Certificate Signing Request (CSR)

Next, click ADD in the Certificate Signing Requests widget.

You can use default settings except for the Common Name and Subject Alternate Names fields.

LetsEncryptCSR

Enter your primary domain name in the Common Name field, then enter additional domains you wish to secure in the Subject Alternate Names field.

For example, if your primary domain is domain1.com, entering www.domain1.com secures both addresses.

Create ACME Certificate

Click the icon next to the new CSR.

LetsEncryptACMECertificate

Fill out the ACME Certificate form. Under Domains, select the ACME DNS Authenticator you created for both domains, then click Save.

You can create testing and staging certificates for your domain.

Set the GUI SSL Certificate

Go to System Settings > General and click Settings in the GUI widget.

Select the new ACME certificate you created from the GUI SSL Certificate dropdown, then click Save.

Select the Confirm checkbox, then press Continue to restart TrueNAS and apply the changes.