Skip to main content

Tutorial: Install Web SSL Certificates on Access Server Using Google Trust Services, ZeroSSL, SSL.com, or Actalis

Abstract

Install a browser-trusted SSL certificate on Access Server using the built-in ACME client — covers Google Trust Services (TLS-ALPN-01, cluster-compatible), ZeroSSL, SSL.com, and Actalis (HTTP-01), with automatic renewal via sacli.

Overview

Access Server secures the Admin Web UI and Client Web UI with an SSL/TLS certificate. During installation, Access Server generates a self-signed certificate so you can access the web interfaces immediately. Because browsers don’t trust that certificate by default, users typically see a self-signed certificate warning when opening the interfaces.

This tutorial shows you how to replace the self-signed certificate with a browser-trusted SSL certificate issued by one of these certificate authorities:

  • Google Trust Services

  • ZeroSSL

  • SSL.com

  • Actalis

Access Server uses the ACME protocol, the standard used by Let’s Encrypt and other certificate authorities to automate certificate issuance and renewal. After you complete the configuration, Access Server uses sacli to request and install the certificate and handles automatic renewal through its ACME client.

The procedures in this tutorial require a fully qualified domain name that resolves to your Access Server.

For a Let’s Encrypt certificate, refer to Tutorial: How to Use ACME Client to Issue Web SSL Certificates for the Access Server UI.

If you prefer a system-managed Certbot deployment, refer to Tutorial: Install a Let's Encrypt Wildcard SSL Certificate on Access Server with Certbot. The Certbot method is the better option when you need a wildcard certificate.

Browser-trusted certificates are also a foundational requirement for secure zero trust network access deployments.

Prerequisites

Before you begin, ensure you have:

  • Access Server 3.1.0 or newer.

  • Console access and the ability to get root access.

  • A fully qualified domain name, such as vpn.example.com.

  • A public DNS record that resolves the domain to the Access Server IP address.

  • An account with the certificate authority you plan to use.

  • The required inbound ports allowed through any host firewall, network firewall, cloud firewall, or security group.

    Tip

    Review SSL Certificates reference for background information about web certificates in Access Server.

Required ports

The required validation port depends on the certificate authority:

Certificate authority

Challenge

Required inbound port

Google Trust Services

TLS-ALPN-01

TCP 443 or the configured web service port

ZeroSSL

HTTP-01

TCP 80

SSL.com

HTTP-01

TCP 80

Actalis

HTTP-01

TCP 80

The TLS-ALPN-01 challenge validates domain ownership over TLS port 443 without requiring port 80. The HTTP-01 challenge validates domain ownership by requesting a temporary validation resource over TCP port 80.

Important: Cluster mode

Access Server clusters support only the TLS-ALPN-01 challenge for ACME certificate validation.

For cluster deployments, use either:

  • Let's Encrypt, which uses TLS-ALPN-01 by default with Access Server.

  • Google Trust Services, the only additional certificate authority covered in this tutorial that supports the TLS-ALPN-01 workflow used by Access Server clusters.

ZeroSSL, SSL.com, and Actalis use the HTTP-01 challenge in the procedures in this tutorial and aren't supported for certificate issuance in cluster mode.

Important: Manually installed certificates

Don’t use the ACME client in this tutorial if you plan to install a certificate manually from a certificate authority such as DigiCert, GoDaddy, or GlobalSign.

Instead, refer to Tutorial: Install a Signed SSL Certificate from the Command-line Interface.

If you install a manual certificate while the ACME client remains enabled, Access Server replaces it during the next automatic renewal.

To disable the ACME client, run:

sacli --key "acme.enable" --value "false" ConfigPut
sacli start

Note

Web SSL certificates secure the Admin Web UI and Client Web UI. They are separate from the certificates Access Server uses for VPN connections. Replacing the web certificate doesn’t change VPN certificates.

Note

In our documentation, we use example IPv4 addresses and subnets reserved for documentation, such as 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24.

Ensure you replace them with valid IPv4 addresses and subnets for your network(s).

Choose a certificate authority

Choose the certificate authority that fits your deployment.

Google Trust Services

Use Google Trust Services when:

  • Access Server is operating in cluster mode.

  • TCP port 80 isn't available.

  • You want to use the TLS-ALPN-01 challenge.

Continue to Issue a certificate with Google Trust Services.

ZeroSSL

Use ZeroSSL when:

  • Access Server isn't operating in cluster mode.

  • TCP port 80 is reachable from the internet.

  • You have ZeroSSL External Account Binding credentials.

Continue to Issue a certificate with ZeroSSL.

SSL.com

Use SSL.com when:

  • Access Server isn't operating in cluster mode.

  • TCP port 80 is reachable from the internet.

  • You have SSL.com ACME credentials.

Continue to Issue a certificate with SSL.com.

Actalis

Use Actalis when:

  • Access Server isn't operating in cluster mode.

  • TCP port 80 is reachable from the internet.

  • You have Actalis ACME credentials.

Continue to Issue a certificate with Actalis.

Issue a certificate with Google Trust Services

Google Trust Services uses the TLS-ALPN-01 challenge and is the certificate authority in this tutorial that supports Access Server cluster mode.

Step 1: Create or select a Google Cloud project

  1. Open the Google Cloud console.

  2. Sign in or create an account.

  3. Create a Google Cloud project or select an existing project.

  4. Open Cloud Shell from the Google Cloud console.

Step 2: Create External Account Binding credentials

External Account Binding (EAB) credentials associate the Access Server ACME client with your account at the certificate authority. They consist of a key identifier and an HMAC key.

  1. In Google Cloud Shell, enable the Public Certificate Authority API:

    gcloud services enable publicca.googleapis.com

  2. Create the EAB credentials:

    gcloud publicca external-account-keys create

    • Example output:

      Created an external account key
[b64MacKey: ABC123
keyId: DEF456

  3. Locate the following values in the output:

    • keyID: The EAB key identifier.

    • b64MacKey: The EAB HMAC key.

  4. Copy both values and store them securely. You need them when configuring Access Server.

Step 3: Configure Access Server for Google Trust Services

Access Server includes sacli, its command-line administration utility. For an introduction to the tool, refer to Tutorial: An Intro to the sacli Command-Line Utility.

  1. Connect to the Access Server console and get root privileges.

  2. Configure the domain for the certificate:

    sacli --key "acme.domains.0" --value "vpn.example.com"1 ConfigPut

    1

    Replace vpn.example.com with your Access Server domain.

  3. Configure the Google Trust Services ACME directory:

    sacli --key "acme.url" --value "https://dv.acme-v02.api.pki.goog/directory" ConfigPut

  4. Configure the EAB key identifier:

    sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

  5. Configure the EAB HMAC key:

    sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

  6. Configure an email address for ACME account registration:

    sacli --key "acme.email" --value "<EMAIL_ADDRESS>" ConfigPut

    Important

    The email address is required for Google Trust Services account registration.

  7. Restart Access Server services:

    sacli start

Step 4: Register the Google Trust Services ACME account

  1. Register an account with the ACME CA:

    sacli AcmeRegisterAccount

  2. Review the certificate authority's Terms of Service.

  3. Enter y when prompted to accept them.

    • Example output:

      > Accept terms of service (ToS) for the ACME service at: https://pki.goog/GTS-SA.pdf?:y
Terms of service https://pki.goog/GTS-SA.pdf accepted
{'account': 'https://dv.acme-v02.api.pki.goog/account/JNWhaCAIfGG7-HvJNWha'}

Step 5: Request the Google Trust Services certificate

  1. Request the certificate:

    sacli AcmeRequestCertificate

  2. Wait for Access Server to complete the TLS-ALPN-01 challenge.

  3. Confirm that the command completes without an error.

    • Access Server requests, installs, and begins using the Google Trust Services certificate.

Continue to Verify the browser-trusted certificate.

Issue a certificate with ZeroSSL

ZeroSSL uses the HTTP-01 challenge. TCP port 80 must be reachable from the internet during validation.

Step 1: Create a ZeroSSL account

  1. Open the ZeroSSL account portal.

  2. Create an account or sign in.

  3. Navigate to Dashboard → Developer.

  4. Select Developer Section.

Step 2: Create External Account Binding credentials

  1. Under EAB Credentials for ACME Clients, select Generate.

  2. Copy the following values:

    • EAB key identifier.

    • EAB HMAC key.

  3. Store both values securely.

Step 3: Configure Access Server for ZeroSSL

  1. Connect to the Access Server console and get root privileges.

  2. Configure the domain for the certificate:

    sacli --key "acme.domains.0" --value "vpn.example.com"1 ConfigPut

    1

    Replace vpn.example.com with your Access Server domain.

  3. Configure the ZeroSSL ACME directory:

    sacli --key "acme.url" --value "https://acme.zerossl.com/v2/DV90" ConfigPut

  4. Enable the standalone HTTP-01 challenge:

    sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

  5. Configure the EAB key identifier:

    sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

  6. Configure the EAB HMAC key:

    sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

  7. Restart Access Server services:

    sacli start

Step 4: Register the ZeroSSL ACME account

  1. Register an account with the ACME CA:

    sacli AcmeRegisterAccount

  2. Review the certificate authority's Terms of Service.

  3. Enter y when prompted to accept them.

    • Example output:

      > Accept terms of service (ToS) for the ACME service at: https://www.sectigo.com/uploads/legal/Certificate-Subscriber-Agreement-3.0-click.pdf?:y
Terms of service https://www.sectigo.com/uploads/legal/Certificate-Subscriber-Agreement-3.0-click.pdf accepted
{'account': 'https://acme.zerossl.com/v2/DV90/account/JNWhaCAIfGG7-HvJNWha'}

Step 5: Request the ZeroSSL certificate

  1. Confirm that TCP port 80 is reachable from the internet.

  2. Request the certificate:

    sacli AcmeRequestCertificate

  3. Wait for Access Server to complete the HTTTP-01 challenge.

  4. Confirm that the command completes without an error.

    • Access Server requests, installs, and begins using the ZeroSSL certificate.

Continue to Verify the browser-trusted certificate.

Issue a certificate with SSL.com

SSL.com uses the HTTP-01 challenge. TCP port 80 must be reachable from the internet during validation.

Step 1: Create an SSL.com account

  1. Open the SSL.com account portal.

  2. Create an account or sign in.

  3. Navigate to Dashboard → developers and integration.

  4. Select api credentials.

Step 2: Copy the SSL.com ACME credentials

  1. Locate the following credentials:

    • Account/ACME Key.

    • HMAC Key.

  2. Copy both values and store them securely.

    Note

    Use the Account/ACME Key as the EAB key identifier in the Access Server configuration.

Step 3: Configure Access Server for SSL.com

  1. Connect to the Access Server console and get root privileges.

  2. Configure the domain for the certificate:

    sacli --key "acme.domains.0" --value "vpn.example.com"1 ConfigPut

    1

    Replace vpn.example.com with your Access Server domain.

  3. Configure the SSL.com ACME directory:

    sacli --key "acme.url" --value "https://acme.ssl.com/sslcom-dv-ecc" ConfigPut

  4. Enable the standalone HTTP-01 challenge:

    sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

  5. Configure the SSL.com Account/ACME Key:

    sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

  6. Configure the EAB HMAC key:

    sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

  7. Configure an email address for ACME account registration:

    sacli --key "acme.email" --value "<EMAIL_ADDRESS>" ConfigPut

    Important

    The email address is required for SSL.com account registration.

  8. Configure the certificate key algorithm:

    sacli --key "acme.cert_algorithm" --value "secp256r1" ConfigPut

  9. Configure the ACME account key algorithm:

    sacli --key "acme.api_key_algorithm" --value "secp256r1" ConfigPut

  10. Restart Access Server services:

    sacli start

Step 4: Register the SSL.com ACME account

  1. Register an account with the ACME CA:

    sacli AcmeRegisterAccount

  2. Review the certificate authority's Terms of Service.

  3. Enter y when prompted to accept them.

    • Example output:

      > Accept terms of service (ToS) for the ACME service at: https://legal.ssl.com/documents/SSLcom-Subscriber-Agreement-v1.4.pdf?:y
Terms of service https://legal.ssl.com/documents/SSLcom-Subscriber-Agreement-v1.4.pdf accepted
{'account': 'https://acme.ssl.com/ejbca/acme/sslcom-dv-ecc/acct/JNWhaCAIfGG7-HvJNWha'}

Step 5: Request the SSL.com certificate

  1. Confirm that TCP port 80 is reachable from the internet.

  2. Request the certificate:

    sacli AcmeRequestCertificate

  3. Wait for Access Server to complete the HTTTP-01 challenge.

  4. Confirm that the command completes without an error.

    • Access Server requests, installs, and begins using the SSL.com certificate.

Continue to Verify the browser-trusted certificate.

Issue a certificate with Actalis

Actalis uses the HTTP-01 challenge. TCP port 80 must be reachable from the internet during validation.

Step 1: Create an Actalis account

  1. Open the Actalis website.

  2. Create an account or sign in.

  3. Navigate to Customer Area → Dashboard.

  4. Select Manage with ACME.

Step 2: Copy the Actalis ACME credentials

  1. Under ACME Credentials → Domain Validation — 90 days, locate:

    • Key ID.

    • HMAC Key.

  2. Copy both values and store them securely.

Step 3: Configure Access Server for Actalis

  1. Connect to the Access Server console and get root privileges.

  2. Configure the domain for the certificate:

    sacli --key "acme.domains.0" --value "vpn.example.com"1 ConfigPut

    1

    Replace vpn.example.com with your Access Server domain.

  3. Configure the Actalis ACME directory:

    sacli --key "acme.url" --value "https://acme-api.actalis.com/acme/directory" ConfigPut

  4. Enable the standalone HTTP-01 challenge:

    sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

  5. Configure the EAB key identifier:

    sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

  6. Configure the EAB HMAC key:

    sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

  7. Restart Access Server services:

    sacli start

Step 4: Register the Actalis ACME account

  1. Register an account with the ACME CA:

    sacli AcmeRegisterAccount

  2. Review the certificate authority's Terms of Service.

  3. Enter y when prompted to accept them.

    • Example output:

      > Accept terms of service (ToS) for the ACME service at: https://www.actalis.it/acme/terms?:y
Terms of service https://www.actalis.it/acme/terms accepted
{'account': 'https://acme-api.actalis.com/acme/acct/NWhaCAIfGG7-HvJNWha'}

Step 5: Request the Actalis certificate

  1. Confirm that TCP port 80 is reachable from the internet.

  2. Request the certificate:

    sacli AcmeRequestCertificate

  3. Wait for Access Server to complete the HTTTP-01 challenge.

  4. Confirm that the command completes without an error.

    • Access Server requests, installs, and begins using the Acttalis certificate.

Continue to Verify the browser-trusted certificate.

Verify the browser-trusted certificate

Complete these checks after requesting a certificate from any of the supported certificate authorities.

Step 1: Verify the certificate in a browser

  1. Open the Admin Web UI using the configured hostname:

    https://vpn.example.com/admin

  2. Open the Client Web UI:

    https://vpn.example.com

  3. Confirm that the browser no longer displays a self-signed certificate warning.

  4. Open the browser's certificate or site information panel.

  5. Confirm that:

    • The certificate hostname matches the Access Server domain.

    • The expected certificate authority issued the certificate.

    • The certificate is within its validity period.

    • The browser trusts the certificate chain.

    Note

    Browser interfaces vary. Depending on the browser, certificate and connection details may appear under a lock, tune, shield, or site information icon.

Step 2: Verify the certificate in the Admin Web UI

  1. Sign in to the Admin Web UI.

  2. Navigate to Certificate Management.

  3. Select the Web Server Certificate tab.

  4. Confirm that the expected certificate appears.

  5. Select See full certificate details, if needed.

  6. Verify:

    • Subject.

    • Issuer.

    • Expiration date.

Step 3: Verify the certificate from the command line

  1. Connect to the console and get root privileges.

  2. Run:

    sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -text -noout|head -n 11

    • Example output:

      Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            34:02:01:71:92:2c:15:c9:5a:76:c1:af:8c:bd:8d:ab
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Domain Validated TLS Server ECC CA 2025
        Validity
            Not Before: Jul 28 12:35:40 2026 GMT
            Not After : Oct 28 13:34:40 2026 GMT
        Subject:

  3. Confirm that the output displays:

    • The expected certificate issuer.

    • A current validity period.

    • The configured Access Server domain.

Step 4: Verify the Subject Alternative Name

  1. Run:

    sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -noout -ext subjectAltName

    • Example output:

      X509v3 Subject Alternative Name: critical
    DNS:vpn.example.com

  2. Confirm that the configured Access Server domain appears as a DNS entry.

Automatic renewal

After the ACME configuration is enabled, Access Server’s ACME client manages automatic certificate renewal.

To avoid renewal failures:

  • Keep the required challenge port reachable.

  • Keep the domain pointed to the correct Access Server IP address.

  • Don’t replace the ACME-managed certificate manually.

  • Keep the certificate authority account and EAB credentials valid.

  • Review Access Server logs if the certificate approaches expiration without renewing.

After renewal, verify that the Admin and Client Web UIs present the new certificate.

Troubleshooting

Account registration fails

  1. Confirm that the ACME directory URL is correct for the selected certificate authority.

  2. Confirm that the EAB key identifier and HMAC key were entered correctly.

  3. Confirm that the configured email address is present when required.

  4. Run sacli AcmeRegisterAccount again.

  5. Review the output for account or Terms of Service errors.

Domain validation fails

  1. Confirm that the domain resolves to the correct public IP address.

  2. Confirm that the required port is reachable from the internet.

  3. Confirm that no reverse proxy, load balancer, or firewall is intercepting the validation request.

  4. Confirm that the selected validation method is supported by the certificate authority.

  5. In cluster mode, confirm that you’re using Google Trust Services with TLS-ALPN-01.

The browser still displays a certificate warning

  1. Confirm that you opened Access Server using the certificate hostname rather than its IP address.

  2. Confirm that the certificate Subject Alternative Name contains the hostname.

  3. Confirm that the expected certificate is displayed under Certificate Management.

  4. Confirm that the certificate is currently valid.

  5. Close and reopen the browser.

  6. Test from another browser or device to rule out cached certificate information.

A manually installed certificate is replaced

The ACME client remains enabled and has renewed or reissued the configured certificate.

To stop ACME certificate management:

  1. Connect to the console and get root privileges.

  2. Run:

    sacli --key "acme.enable" --value "false" ConfigPut

  3. Restart Access Server:

    sacli start

  4. Reinstall the manual certificate by following: Tutorial: Install a Signed SSL Certificate from the Command-line Interface.

See also

In this section:

Access Server's web server used by the administrator to configure the VPN server.

Access Server's web server used by clients to download OpenVPN Connect and configuration profiles.