Manage Certificates - Networking4all ACME Documentation

We will now discuss how you can perform common certificate operations through ACME. Note that if your certificate was ordered through ACME certain operations (like reissues and renewals) become unavailable in our portal and API for that certificate. This is to prevent certificate modification that your ACME client can not be aware of which could lead to unexpected actions being taken by the client. You can contact us to re-enable this for certificates you no longer wish to manage through ACME.

View certificate

View your certificate(s).

sudo certbot certificates

acme.sh --list

wacs --list --baseuri <SELECTED-SERVER>

You only need to add the --baseuri parameter if you did not add the networking4all ACME server to your settings.json file or if you use a variety of <PRODUCT> types.

Renew

Renew a certificate. While most clients schedule a job to automatically renew certificates when they are close to expiry, you can renew certificates manually if you want to. Note that if you try to renew a certificate too early it will simply be reissued at no extra costs.

Renew all certificates close to expiry

sudo certbot renew

Renew a specific certificate - first find the certificate name using sudo certbot certificates and then use the following command:

sudo certbot renew --cert-name <CERTIFICATE-NAME>

First find the certificate name using acme.sh --list and then use the following command:

acme.sh --renew -d <CERT-NAME>

First find the ID or name of the certificate using wacs --list and then use one of the following commands:

wacs --renew --id <CERTIFICATE-ID> --baseuri <SELECTED-SERVER>

Note that the certificate name is not always the same as the domain name.

wacs --renew --friendlyname <CERTIFICATE-NAME> --baseuri <SELECTED-SERVER>

You only need to add the --baseuri parameter if you did not add the networking4all ACME server to your settings.json file or if you use a variety of <PRODUCT> types.

Cancel renewal

Cancel the automatic renewal of a certificate. In case you want to stop using a certificate immediately, without revoking it, use delete instead.

Open the renewal configuration file for the certificate, this file should be located at /etc/letsencrypt/renewal/example.com.conf. Under the [renewalparams] section add renewal = false.

Alternatively you can simply remove the configuration file or change the extension:

sudo mv /etc/letsencrypt/renewal/example.com.conf /etc/letsencrypt/renewal/example.com.conf.disabled

First find the certificate name using acme.sh --list and then use the following command:

acme.sh --remove -d <CERT-NAME>

First find the ID or name of the certificate using wacs --list and then use one of the following commands:

wacs --cancel --id <CERTIFICATE-ID> --baseuri <SELECTED-SERVER>

Note that the certificate name is not always the same as the domain name.

wacs --cancel --friendlyname <CERTIFICATE-NAME> --baseuri <SELECTED-SERVER>

You only need to add the --baseuri parameter if you did not add the networking4all ACME server to your settings.json file or if you use a variety of <PRODUCT> types.

Revoke

Revoke a certificate.

Be careful if you do this while a certificate is actively in use, your service will likely become unavailable to clients! Revoking a certificate while your webserver configuration is managed by your ACME client will likely require you to manually update the configuration file before you can order again!

First find the certificate path using sudo certbot certificates and then use the following command (note that you need to include the server):

sudo certbot revoke --cert-name <CERTIFICATE-NAME> --server <SELECTED-SERVER>

After revocation, Certbot will (by default) ask whether you want to delete the certificate. Unless deleted, Certbot will try to renew revoked certificates the next time certbot renew runs.

First find the certificate name using acme.sh --list and then use the following command:

acme.sh --revoke -d <CERT-NAME>

First find the ID or name of the certificate using wacs --list and then use one of the following commands:

wacs --revoke --id <CERTIFICATE-ID> --baseuri <SELECTED-SERVER>

Note that the certificate name is not always the same as the domain name.

wacs --revoke --friendlyname <CERTIFICATE-NAME> --baseuri <SELECTED-SERVER>

You only need to add the --baseuri parameter if you did not add the networking4all ACME server to your settings.json file or if you use a variety of <PRODUCT> types.

Delete

Delete a local certificate. Note that this does not delete, cancel, or revoke a certificate at Networking4all.

Do not use delete instead of revoke when a certificate needs to be revoked unless it has already been revoked through other means! Be careful if you do this while a certificate is actively in use, your service may become unavailable to clients!

First find the certificate name using sudo certbot certificates and then use the following command:

sudo certbot delete --cert-name <CERTIFICATE-NAME>

Instead you can also omit the --cert-name parameter and select the certificate you want to delete from the list.

First find the certificate name using acme.sh --list and then use the following command:

acme.sh --remove -d <CERT-NAME>

After this you will have to navigate to your certificate directory, typically found at ~/.acme.sh/example.com_ecc, and delete its contents.

Start simple-acme using wacs --baseuri <SELECTED-SERVER>. Select A: Manage renewals (x total). Select the appropriate certificate and fill in the number. Cancel the renewal.

Now, depending on the store method you chose during the order, you will either have to manually delete the certificate from the Certificates store using MMC or the local path where it was stored.

Other data related to your order can be found at the %ProgramData%\simple-acme\ path.

You only need to add the --baseuri parameter if you did not add the networking4all ACME server to your settings.json file or if you use a variety of <PRODUCT> types.