Tutorial: Install Web SSL Certificates on Access Server Using Google Trust Services, ZeroSSL, SSL.com, or Actalis⁠

Use Google Trust Services when:

• Access Server is operating in cluster mode.

• TCP port 80 isn't available.

• You want to use the TLS-ALPN-01 challenge.

Continue to Issue a certificate with Google Trust Services.

Use ZeroSSL when:

• Access Server isn't operating in cluster mode.

• TCP port 80 is reachable from the internet.

• You have ZeroSSL External Account Binding credentials.

Continue to Issue a certificate with ZeroSSL.

Use SSL.com when:

• Access Server isn't operating in cluster mode.

• TCP port 80 is reachable from the internet.

• You have SSL.com ACME credentials.

Continue to Issue a certificate with SSL.com.

Use Actalis when:

• Access Server isn't operating in cluster mode.

• TCP port 80 is reachable from the internet.

• You have Actalis ACME credentials.

Continue to Issue a certificate with Actalis.

1. Open the Google Cloud console.

2. Sign in or create an account.

3. Create a Google Cloud project or select an existing project.

4. Open Cloud Shell from the Google Cloud console.

External Account Binding (EAB) credentials associate the Access Server ACME client with your account at the certificate authority. They consist of a key identifier and an HMAC key.

1. In Google Cloud Shell, enable the Public Certificate Authority API:

   gcloud services enable publicca.googleapis.com

2. Create the EAB credentials:

   gcloud publicca external-account-keys create

   • Example output:

     Created an external account key
     [b64MacKey: ABC123
     keyId: DEF456

3. Locate the following values in the output:

   • keyID: The EAB key identifier.

   • b64MacKey: The EAB HMAC key.

4. Copy both values and store them securely. You need them when configuring Access Server.

Access Server includes sacli, its command-line administration utility. For an introduction to the tool, refer to Tutorial: An Intro to the sacli Command-Line Utility.

1. Connect to the Access Server console and get root privileges.

2. Configure the domain for the certificate:

   sacli --key "acme.domains.0" --value "vpn.example.com" ConfigPut

   1. 1

      Replace vpn.example.com with your Access Server domain.

3. Configure the Google Trust Services ACME directory:

   sacli --key "acme.url" --value "https://dv.acme-v02.api.pki.goog/directory" ConfigPut

4. Configure the EAB key identifier:

   sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

5. Configure the EAB HMAC key:

   sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

6. Configure an email address for ACME account registration:

   sacli --key "acme.email" --value "<EMAIL_ADDRESS>" ConfigPut

7. Restart Access Server services:

   sacli start

1. Register an account with the ACME CA:

   sacli AcmeRegisterAccount

2. Review the certificate authority's Terms of Service.

3. Enter y when prompted to accept them.

   • Example output:

     > Accept terms of service (ToS) for the ACME service at: https://pki.goog/GTS-SA.pdf?:y
     Terms of service https://pki.goog/GTS-SA.pdf accepted
     {'account': 'https://dv.acme-v02.api.pki.goog/account/JNWhaCAIfGG7-HvJNWha'}

1. Request the certificate:

   sacli AcmeRequestCertificate

2. Wait for Access Server to complete the TLS-ALPN-01 challenge.

3. Confirm that the command completes without an error.

   • Access Server requests, installs, and begins using the Google Trust Services certificate.

Continue to acme client Verify the browser-trusted certificate.

1. Open the ZeroSSL account portal.

2. Create an account or sign in.

3. Navigate to Dashboard → Developer.

4. Select Developer Section.

1. Under EAB Credentials for ACME Clients, select Generate.

2. Copy the following values:

   • EAB key identifier.

   • EAB HMAC key.

3. Store both values securely.

1. Connect to the Access Server console and get root privileges.

2. Configure the domain for the certificate:

   sacli --key "acme.domains.0" --value "vpn.example.com" ConfigPut

   1. 1

      Replace vpn.example.com with your Access Server domain.

3. Configure the ZeroSSL ACME directory:

   sacli --key "acme.url" --value "https://acme.zerossl.com/v2/DV90" ConfigPut

4. Enable the standalone HTTP-01 challenge:

   sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

5. Configure the EAB key identifier:

   sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

6. Configure the EAB HMAC key:

   sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

7. Restart Access Server services:

   sacli start

1. Register an account with the ACME CA:

   sacli AcmeRegisterAccount

2. Review the certificate authority's Terms of Service.

3. Enter y when prompted to accept them.

   • Example output:

     > Accept terms of service (ToS) for the ACME service at: https://www.sectigo.com/uploads/legal/Certificate-Subscriber-Agreement-3.0-click.pdf?:y
     Terms of service https://www.sectigo.com/uploads/legal/Certificate-Subscriber-Agreement-3.0-click.pdf accepted
     {'account': 'https://acme.zerossl.com/v2/DV90/account/JNWhaCAIfGG7-HvJNWha'}

1. Confirm that TCP port 80 is reachable from the internet.

2. Request the certificate:

   sacli AcmeRequestCertificate

3. Wait for Access Server to complete the HTTTP-01 challenge.

4. Confirm that the command completes without an error.

   • Access Server requests, installs, and begins using the ZeroSSL certificate.

Continue to acme client Verify the browser-trusted certificate.

1. Open the SSL.com account portal.

2. Create an account or sign in.

3. Navigate to Dashboard → developers and integration.

4. Select api credentials.

1. Locate the following credentials:

   • Account/ACME Key.

   • HMAC Key.

2. Copy both values and store them securely.

1. Connect to the Access Server console and get root privileges.

2. Configure the domain for the certificate:

   sacli --key "acme.domains.0" --value "vpn.example.com" ConfigPut

   1. 1

      Replace vpn.example.com with your Access Server domain.

3. Configure the SSL.com ACME directory:

   sacli --key "acme.url" --value "https://acme.ssl.com/sslcom-dv-ecc" ConfigPut

4. Enable the standalone HTTP-01 challenge:

   sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

5. Configure the SSL.com Account/ACME Key:

   sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

6. Configure the EAB HMAC key:

   sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

7. Configure an email address for ACME account registration:

   sacli --key "acme.email" --value "<EMAIL_ADDRESS>" ConfigPut

8. Configure the certificate key algorithm:

   sacli --key "acme.cert_algorithm" --value "secp256r1" ConfigPut

9. Configure the ACME account key algorithm:

   sacli --key "acme.api_key_algorithm" --value "secp256r1" ConfigPut

10. Restart Access Server services:

    sacli start

1. Register an account with the ACME CA:

   sacli AcmeRegisterAccount

2. Review the certificate authority's Terms of Service.

3. Enter y when prompted to accept them.

   • Example output:

     > Accept terms of service (ToS) for the ACME service at: https://legal.ssl.com/documents/SSLcom-Subscriber-Agreement-v1.4.pdf?:y
     Terms of service https://legal.ssl.com/documents/SSLcom-Subscriber-Agreement-v1.4.pdf accepted
     {'account': 'https://acme.ssl.com/ejbca/acme/sslcom-dv-ecc/acct/JNWhaCAIfGG7-HvJNWha'}

1. Confirm that TCP port 80 is reachable from the internet.

2. Request the certificate:

   sacli AcmeRequestCertificate

3. Wait for Access Server to complete the HTTTP-01 challenge.

4. Confirm that the command completes without an error.

   • Access Server requests, installs, and begins using the SSL.com certificate.

Continue to acme client Verify the browser-trusted certificate.

1. Open the Actalis website.

2. Create an account or sign in.

3. Navigate to Customer Area → Dashboard.

4. Select Manage with ACME.

1. Under ACME Credentials → Domain Validation — 90 days, locate:

   • Key ID.

   • HMAC Key.

2. Copy both values and store them securely.

1. Connect to the Access Server console and get root privileges.

2. Configure the domain for the certificate:

   sacli --key "acme.domains.0" --value "vpn.example.com" ConfigPut

   1. 1

      Replace vpn.example.com with your Access Server domain.

3. Configure the Actalis ACME directory:

   sacli --key "acme.url" --value "https://acme-api.actalis.com/acme/directory" ConfigPut

4. Enable the standalone HTTP-01 challenge:

   sacli --key "acme.allow_http_standalone" --value "true" ConfigPut

5. Configure the EAB key identifier:

   sacli --key "acme.eab_kid" --value "<EAB_KID_VALUE>" ConfigPut

6. Configure the EAB HMAC key:

   sacli --key "acme.eab_hmac_key" --value "<EAB_HMAC_KEY>" ConfigPut

7. Restart Access Server services:

   sacli start

1. Register an account with the ACME CA:

   sacli AcmeRegisterAccount

2. Review the certificate authority's Terms of Service.

3. Enter y when prompted to accept them.

   • Example output:

     > Accept terms of service (ToS) for the ACME service at: https://www.actalis.it/acme/terms?:y
     Terms of service https://www.actalis.it/acme/terms accepted
     {'account': 'https://acme-api.actalis.com/acme/acct/NWhaCAIfGG7-HvJNWha'}

1. Confirm that TCP port 80 is reachable from the internet.

2. Request the certificate:

   sacli AcmeRequestCertificate

3. Wait for Access Server to complete the HTTTP-01 challenge.

4. Confirm that the command completes without an error.

   • Access Server requests, installs, and begins using the Acttalis certificate.

Continue to acme client Verify the browser-trusted certificate.

1. Open the Admin Web UI using the configured hostname:

   https://vpn.example.com/admin

2. Open the Client Web UI:

   https://vpn.example.com

3. Confirm that the browser no longer displays a self-signed certificate warning.

4. Open the browser's certificate or site information panel.

5. Confirm that:

   • The certificate hostname matches the Access Server domain.

   • The expected certificate authority issued the certificate.

   • The certificate is within its validity period.

   • The browser trusts the certificate chain.

1. Sign in to the Admin Web UI.

2. Navigate to Certificate Management.

3. Select the Web Server Certificate tab.

4. Confirm that the expected certificate appears.

5. Select See full certificate details, if needed.

6. Verify:

   • Subject.

   • Issuer.

   • Expiration date.

1. Connect to the console and get root privileges.

2. Run:

   sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -text -noout|head -n 11

   • Example output:

     Certificate:
         Data:
             Version: 3 (0x2)
             Serial Number:
                 34:02:01:71:92:2c:15:c9:5a:76:c1:af:8c:bd:8d:ab
             Signature Algorithm: ecdsa-with-SHA384
             Issuer: C = IT, ST = Bergamo, L = Ponte San Pietro, O = Actalis S.p.A., CN = Actalis Domain Validated TLS Server ECC CA 2025
             Validity
                 Not Before: Jul 28 12:35:40 2026 GMT
                 Not After : Oct 28 13:34:40 2026 GMT
             Subject:

3. Confirm that the output displays:

   • The expected certificate issuer.

   • A current validity period.

   • The configured Access Server domain.

1. Run:

   sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -noout -ext subjectAltName

   • Example output:

     X509v3 Subject Alternative Name: critical
         DNS:vpn.example.com

2. Confirm that the configured Access Server domain appears as a DNS entry.

1. Confirm that the ACME directory URL is correct for the selected certificate authority.

2. Confirm that the EAB key identifier and HMAC key were entered correctly.

3. Confirm that the configured email address is present when required.

4. Run sacli AcmeRegisterAccount again.

5. Review the output for account or Terms of Service errors.

1. Confirm that the domain resolves to the correct public IP address.

2. Confirm that the required port is reachable from the internet.

3. Confirm that no reverse proxy, load balancer, or firewall is intercepting the validation request.

4. Confirm that the selected validation method is supported by the certificate authority.

5. In cluster mode, confirm that you’re using Google Trust Services with TLS-ALPN-01.

1. Confirm that you opened Access Server using the certificate hostname rather than its IP address.

2. Confirm that the certificate Subject Alternative Name contains the hostname.

3. Confirm that the expected certificate is displayed under Certificate Management.

4. Confirm that the certificate is currently valid.

5. Close and reopen the browser.

6. Test from another browser or device to rule out cached certificate information.

The ACME client remains enabled and has renewed or reissued the configured certificate.

To stop ACME certificate management:

1. Connect to the console and get root privileges.

2. Run:

   sacli --key "acme.enable" --value "false" ConfigPut

3. Restart Access Server:

   sacli start

4. Reinstall the manual certificate by following: Tutorial: Install a Signed SSL Certificate from the Command-line Interface.