Tutorial: Issue Let's Encrypt SSL Certificates via the Access Server Web API, Including IP Address Certificates⁠

Use an FQDN certificate when users open Access Server with a hostname such as:

https://vpn.example.com

Continue to acme api Issue an SSL certificate for FQDN.

Use an IP address certificate when users open Access Server directly with its public IP address, such as:

https://203.0.113.5

This provides a browser-trusted certificate without a domain name.

Continue to acme api Issue an SSL certificate for an IP address.

1. Connect to the console and get root privileges.

2. Configure the FQDN that should receive the certificate:

   sacli --method POST --url 'api/config-items/Default' --value '{"acme.domains.0": "<ACCESS_SERVER_DOMAIN>"}' apicall

   • A successful request returns:

     null

3. Restart Access Server services:

   sacli --method POST --url 'api/server/restart?restartMode=warm' --value '' apicall

   • Example output:

     {}

1. Register an account with the ACME CA:

   sacli --method POST --url 'api/acme/register-account' --value '{}' apicall

   • Example output:

     {"account":"https://acme-v02.api.letsencrypt.org/acme/acct/3570987755"}

2. Confirm the response contains an ACME account URL.

1. Request the certificate:

   sacli --method POST --url 'api/acme/request-certificate' --value '{}' apicall

2. Wait for Access Server to complete the ACME validation.

3. Confirm that the command completes without an error.

   • Example output:

     null

   • Access Server requests and installs the Let's Encrypt certificate for the configured FQDN.

Continue to acme api Verify an FQDN certificate.

1. Open the Admin Web UI using the configured hostname:

   https://<ACCESS_SERVER_DOMAIN>/admin

2. Open the Client Web UI:

   https://<ACCESS_SERVER_DOMAIN>

3. Confirm that the browser no longer displays a self-signed certificate warning.

4. Open the browser's certificate or site information panel.

5. Confirm that:

   • The certificate hostname matches the Access Server FQDN.

   • Let's Encrypt issued the certificate.

   • The certificate is within its validity period.

   • The browser trusts the certificate chain.

1. Sign in to the Admin Web UI.

2. Navigate to Certificate Management.

3. Select the Web Server Certificate tab.

4. Confirm that the expected certificate appears.

5. Select See full certificate details, if needed.

6. Verify:

   • Subject.

   • Issuer.

   • Expiration date.

1. Connect to the console and get root privileges.

2. Verify via apicall:

   sacli --method POST --url 'api/certificate/info' --value "{\"certificate\": \"$(sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4)\"}" apicall

   • Example output:

     {"serial":"506116826303089592917918274713470173092603","common_name":"<ACCESS_SERVER_DOMAIN>","algorithm":"secp384r1","not_before":"2026-07-26T14:26:50Z","not_after":"2026-10-24T14:26:49Z","self_signed":false,"sha256fp":"10:9b:5f:50:a6:85:ab:b4:94:bb:71:58:13:da:18:6b:80:0c:2a:f8:07:bf:a3:94:7e:c4:63:95:c7:28:e7:8d","subject":["CN=<ACCESS_SERVER_DOMAIN>"],"issuer":["CN=YE1","O=Let's Encrypt","C=US"],"subj_alt_names":["DNS:<ACCESS_SERVER_DOMAIN>"],"ca":false}

3. Confirm that:

   • self_signed is false.

   • The issuer is Let's Encrypt.

   • The certificate is within its validity period.

   • subj_alt_names contains the expected DNS hostname.

1. Verify with OpenSSL:

   sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -text -noout|head -n 11

   • Example output:

     Certificate:
         Data:
             Version: 3 (0x2)
             Serial Number:
                 05:cf:57:fb:1d:10:a7:56:9f:d6:a1:97:75:e9:80:66:9a:fb
             Signature Algorithm: ecdsa-with-SHA384
             Issuer: C = US, O = Let's Encrypt, CN = YE1
             Validity
                 Not Before: Jul 26 14:26:50 2026 GMT
                 Not After : Oct 24 14:26:49 2026 GMT
             Subject: CN = <ACCESS_SERVER_DOMAIN>

2. Confirm the issuer, validity period, and subject.

Expected result: The Admin Web UI and Client Web UI present a browser-trusted Let’s Encrypt certificate for the configured FQDN.

1. Connect to the console and get root privileges.

2. Configure the public IP address that should receive the certificate:

   sacli --method POST --url 'api/config-items/Default' --value '{"acme.ip_addresses.0": "<ACCESS_SERVER_IP>"}' apicall

   • A successful request returns:

     null

1. Configure the certificate profile for IP certificates:

   sacli --method POST --url 'api/config-items/Default' --value '{"acme.cert_profile": "shortlived"}' apicall

   • A successful request returns:

     null

2. Restart Access Server services:

   sacli --method POST --url 'api/server/restart?restartMode=warm' --value '' apicall

   • Example output:

     {}

1. Register an account with the ACME CA:

   sacli --method POST --url 'api/acme/register-account' --value '{}' apicall

   • Example output:

     {"account":"https://acme-v02.api.letsencrypt.org/acme/acct/3570987755"}

2. Confirm the response contains an ACME account URL.

1. Request the certificate:

   sacli --method POST --url 'api/acme/request-certificate' --value '{}' apicall

2. Wait for Access Server to complete the ACME validation.

3. Confirm that the command completes without an error.

   • Example output:

     null

   • Access Server requests and installs the Let's Encrypt IP address certificate.

Continue to acme api Verify an IP address certificate.

1. Open the Admin Web UI using the configured hostname:

   https://<ACCESS_SERVER_IP>/admin

2. Open the Client Web UI:

   https://<ACCESS_SERVER_IP>

3. Confirm that the browser no longer displays a self-signed certificate warning.

4. Open the browser's certificate or site information panel.

5. Confirm that:

   • The certificate covers the Access Server IP address.

   • Let's Encrypt issued the certificate.

   • The certificate is within its validity period.

   • The browser trusts the certificate chain.

1. Sign in to the Admin Web UI.

2. Navigate to Certificate Management.

3. Select the Web Server Certificate tab.

4. Confirm that the expected certificate appears.

5. Select See full certificate details, if needed.

6. Verify:

   • Subject.

   • Issuer.

   • Expiration date.

1. Connect to the console and get root privileges.

2. Verify via apicall:

   sacli --method POST --url 'api/certificate/info' --value "{\"certificate\": \"$(sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4)\"}" apicall

   • Example output:

     {"serial":"534506998025996180192364413873987588486223","common_name":null,"algorithm":"secp384r1","not_before":"2026-07-26T14:41:47Z","not_after":"2026-08-02T06:41:46Z","self_signed":false,"sha256fp":"c7:86:0a:26:f4:89:55:d0:1a:14:73:8f:94:ce:8a:91:d0:50:17:d4:8b:cf:e9:a5:fc:ea:89:54:5e:d0:09:5f","subject":[],"issuer":["CN=YE2","O=Let's Encrypt","C=US"],"subj_alt_names":["IP:<ACCESS_SERVER_IP>"],"ca":false}

3. Confirm that:

   • self_signed is false.

   • The issuer is Let's Encrypt.

   • The certificate is within its validity period.

   • subj_alt_names contains the expected IP address.

1. Verify with OpenSSL:

   sacli ConfigQuery|grep cs.cert|cut -d '"' -f 4|sed 's/\\n/\n/g'|openssl x509 -noout -ext subjectAltName

   • Example output:

     X509v3 Subject Alternative Name: critical
         IP Address:<ACCESS_SERVER_IP>

2. Confirm the IP address appears under SubjectAltName.

Expected result: The Admin Web UI and Client Web UI present a browser-trusted Let’s Encrypt certificate for the configured IP address.

Access Server begins renewal after 60 days for the 90-day certificate.

To maintain successful renewal:

1. Keep the FQDN pointed to the correct Access Server IP address.

2. Keep the required ACME validation path available.

3. Don’t replace the ACME-managed certificate manually.

4. Review Access Server logs if the certificate approaches expiration without renewing.

Access Server begins renewal after 3 days because the shortlived certificate is valid for only 160 hours.

To maintain successful renewal:

1. Keep the certified public IP address assigned to Access Server.

2. Ensure the ACME validation requirements remain satisfied.

3. Don’t disable the ACME client.

4. Monitor certificate expiration closely if you change networking, firewalls, or public IP addresses.

1. Confirm that Access Server can reach the ACME service.

2. Confirm that the configured FQDN or IP address is correct.

3. Confirm that the appropriate validation traffic can reach Access Server.

4. Confirm that the ACME account was registered successfully.

5. Review the output from the api/acme/request-certificate Web API call.

6. Review the Access Server logs for ACME-related errors.

For an FQDN certificate:

1. Open Access Server using the configured hostname rather than its IP address.

2. Verify that the hostname appears in the certificate Subject Alternative Name.

3. Confirm that the certificate is within its validity period.

4. Confirm that the certificate isn’t self-signed.

For an IP address certificate:

1. Open Access Server using the exact IP address included in the certificate.

2. Verify that the IP address appears in the certificate Subject Alternative Name.

3. Confirm that the short-lived certificate hasn’t expired.

4. Confirm that automatic renewal has completed successfully.