acme-client
This command lets you configure ACME-based management for a TLS Context.
Syntax
(tls-<Index>)# acme-client
|
Command |
Description |
|---|---|
|
account-credentials {delete|import} |
Imports or deletes the credentials of an existing ACME account for the TLS Context. When importing account credentials, paste the ACME account credentials in JSON format and add a new line at the end with only a period (.). |
|
auto-enroll-lifetime-percentage |
Defines when the device triggers automatic certificate renewal via ACME, as a percentage of the certificate's validity period. |
|
disable |
Disables the device as an ACME client. |
|
display-logs |
Displays ACME client logs, for example: Install Log: [Sun Jul 26 11:53:48 ACDT 2026] Installing to /var/AC/cert/acme [Sun Jul 26 11:53:49 ACDT 2026] Installed to /var/AC/cert/acme/acme.sh [Sun Jul 26 11:53:49 ACDT 2026] No profile has been found, you will need to change your working directory to /var/AC/cert/acme to use acme.sh [Sun Jul 26 11:53:55 ACDT 2026] OK Issue Certificate Log: File /var/AC/cert/acme/tls/2/IssueCertLog does not exist |
|
domain-name |
Defines the certificate's primary domain name (FQDN). This becomes the Common Name (CN) or the first Subject Alternative Name (SAN). |
|
enable |
Enables the device as an ACME client. |
|
issue-certificate |
Triggers the device to request certificate issuance from the ACME-compliant CA. |
|
key-algorithm {ec-256|ec-384|ec-521|rsa-2048} |
Defines the key algorithm and size for the issued certificate. |
|
profile |
Assigns an ACME Profile to the TLS Context. The ACME Profile defines the account (e.g., address) that you have with an ACME-compliant Certificate Authority (CA). |
|
refresh-private-key {disable|enable} |
Enables the device to generate a new private key each time it requests a certificate issuance or renewal via ACME. |
|
replace-day {everyday|friday|monday| saturday|sunday|thursday|tuesday|wendesday} |
Defines which day of the week the device performs automatic certificate replacement via ACME. |
|
replace-hour |
Defines the time of day (in hh::mm format) the device performs automatic certificate replacement via ACME. |
|
san |
Defines additional domain names (SANs) for the certificate (separated by a semicolon). |
Command Mode
Privileged User
Example
This example configures the device as an ACME client:
(config-network)# tls 1 (tls-1)# acme-client enable
(tls-1)# acme-client domain-name acme-test-sbc.audiocodes.lu
(tls-1)# acme-client key-algorithm ec-256
(tls-1)# acme-client auto-enroll-lifetime-percentage 80
(tls-1)# acme-client replace-day sunday
(tls-1)# acme-client replace-hour 24:00
(tls-1)# activate