Skip to content

Own certificates, own ACME server, self-signed

These options apply to --expose local, where Tenantry serves HTTPS itself through its Caddy front. For the public-CA methods see TLS certificates.

Your own certificate files

You have a certificate chain and its private key (PEM), for example from your company PKI or a purchased certificate.

sudo scripts/install.sh --name acme --public-url https://tenantry.acme.ch \
  --teleport-local auto \
  --tls files --tls-cert /root/fullchain.pem --tls-key /root/privkey.pem

The installer checks that the key matches the certificate, that it has not expired and that it covers the name. It copies the files to <dir>/certs/. You renew them: replace the files and run install.sh again. Caddy reloads itself.

Your own ACME server

For step-ca or another internal ACME CA, pass its directory URL. Issuance works with HTTP-01 or DNS-01.

sudo scripts/install.sh --name acme --public-url https://tenantry.acme.internal \
  --teleport-local auto \
  --tls acme-http \
  --acme-server https://ca.acme.internal/acme/acme/directory \
  --acme-ca-bundle /root/internal-ca.pem
  • --acme-ca-bundle FILE: the CA certificate of the ACME server itself, when it uses a private CA.
  • --eab-kid KID: External Account Binding. The HMAC key is typed at the prompt, or set as ACME_EAB_HMAC_KEY in the credentials file.
  • Browsers and agents must already trust that CA. Publicly trusted certificates need a public domain; with your own ACME server any name your CA accepts works.

Self-signed (lab only)

sudo scripts/install.sh --name lab --public-url https://tenantry.lab.acme.ch --tls selfsigned

The installer generates an ECDSA certificate valid 397 days. Every browser shows an error. Never use it in production.