Configuring ACME Profiles

The ACME Profiles table lets you configure up to 12 ACME profiles. An ACME profile is a registered account that you have with an ACME-compliant Certificate Authority (CA).

After you configure an ACME profile, you need to do the following:

1. Only if the ACME Profile uses DNS-01 as the challenge type with the DNS provider (see 'Challenge Type' parameter below), you must upload a DNS-01 credentials file to the ACME Profile. For more information, see Uploading DNS-01 Credentials to an ACME Profile.
2. Assign the ACME Profile to a TLS Context in the TLS Contexts table (see Configuring TLS Contexts).

If you're using DNS-01 challenge validation, you need to upload DNS-01 credentials to the ACME Profile (see 'Challenge Type' parameter below).

The following procedure describes how to configure ACME Profiles through the Web interface. You can also configure it through ini file [ACMEProfiles] or CLI (configure network > acme-profile).

➢ To configure SNI-to-TLS Context mapping rules:
1. Open the ACME Profiles table (Setup menu > IP Network tab > Security folder > ACME Profiles).
2. Click New; the following dialog box appears:

1. Configure an ACME Profile according to the parameters described in the table below.
2. Click Apply, and then save your settings to flash memory.

ACME Profiles Table Parameter Descriptions

Parameter

Description

'Index'

[Index]

Defines an index number for the new table record.

Note: The index must be unique.

'Name'

name

[ProfileName]

Defines a name for the ACME Profile.

The valid value is a string of up to 31 characters.

Note: Each row must be configured with a unique name.

'Email Address'

email-address

[EmailAddress]

Defines the email address used to register the device's account with the ACME-compliant CA.

By default, no value is defined.

'Server URL'

server-url

[ACMEServerURL]

Defines the URL of the ACME server.

By default, no value is defined.

'Server Interface'

server-interface

[ServerInterface]

Assigns an IP Interface from the IP Interfaces table (see Configuring IP Network Interfaces) through which the device communicates with the ACME-compliant CA.

By default, no value is defined.

Note: The IP version (IPv4 or IPv6) of the ACME server's URL and the assigned IP Interface must match.

'Server EAB KID'

server-eab-kid

[EABKid]

Defines the External Account Binding (EAB) key identifier (KID), used together with the Server EAB HMAC key to bind the device's ACME account to an existing account at the CA.

By default, no value is defined.

'Server EAB HMAC' Key

server-eab-hmac-key

[EABHMACKey]

Defines the External Account Binding (EAB) HMAC key, used together with the Server EAB KID to bind the device's ACME account to an existing account at the CA.

By default, no value is defined.

'Challenge Type'

challenge-type

[ChallengeType]

Defines the validation method the device uses to prove domain ownership to the ACME-compliant CA.

■ [0] HTTP-01 = The device proves domain ownership by hosting a token at a well-known URL on the domain, which the CA retrieves over HTTP.
■ [1] DNS-01 = The device proves domain ownership by publishing a specific TXT record in the domain's DNS zone, which the CA queries. This is required if you use wildcard domain names in Subject Alternative Names (SAN).

'DNS-01 Credentials Loaded'

Read-only field that displays if you've uploaded a file with the DNS-01 credentials.

Note:

■ The parameter is applicable only when the 'Challenge Type' parameter is configured to DNS-01.
■ The field only appears in the table after you add the row.