acme.Certificate

Controls the timeout in seconds for certificate requests that are made after challenges are complete. Defaults to 30 seconds.

As mentioned, cert_timeout does nothing until all challenges are complete. If you are looking to control timeouts related to a particular challenge (such as a DNS challenge), see that challenge provider's specific options.

A pre-created certificate request, such as one from [tls_cert_request][tls-cert-request], or one from an external source, in PEM format. Forces a new resource when changed.

One of common_name, subject_alternative_names, or certificate_request_pem must be specified. certificate_request_pem conflicts with common_name and subject_alternative_names; You cannot have certificate_request_pem defined at the same time as common_name or subject_alternative_names, and vice versa. Finally, common_name can be blank while subject_alternative_names is defined, and vice versa; in this case with the classic Let's Encrypt profile, the first domain defined in subject_alternative_names becomes the common name.

Disable the requirement for full propagation of the TXT challenge records before proceeding with validation. Defaults to false.

See About DNS propagation checks for details on the recursive_nameservers and disable_complete_propagation settings.

Enables the OCSP Stapling Required TLS Security Policy extension. Certificates with this extension must include a valid OCSP Staple in the TLS handshake for the connection to succeed. Defaults to false. Note that this option has no effect when using an external CSR - it must be enabled in the CSR itself. Forces a new resource when changed.

OCSP stapling requires specific webserver configuration to support the downloading of the staple from the CA's OCSP endpoints, and should be configured to tolerate prolonged outages of the OCSP service. Consider this when using must_staple, and only enable it if you are sure your webserver or service provider can be configured correctly.

Insert a delay after every DNS challenge record to allow for extra time for DNS propagation before the certificate is requested. Use this option if you observe issues with requesting certificates even when DNS challenge records get added successfully. Units are in seconds. Defaults to 0 (no delay).

Be careful with pre_check_delay since the delay is executed per-domain. Take your expected delay and divide it by the number of domains you have configured (common_name + subject_alternative_names).

The common name of the root of a preferred alternate certificate chain offered by the CA. The certificates in issuer_pem will reflect the chain requested, if available, otherwise the default chain will be provided. Forces a new resource when changed.

preferred_chain can be used to request alternate chains on Let's Encrypt during the transition away from their old cross-signed intermediates. See this article for more details. In their example titled "What about the alternate chain?", the root you would put in to the preferred_chain field would be ISRG Root X1. The equivalent in the staging environment is (STAGING) Pretend Pear X1.

The ACME profile to use when requesting the certificate. This can be used to control generation parameters according to the specific CA. The default is blank (no profile); forces a new resource when changed.

Let's Encrypt publishes details on their profiles at https://letsencrypt.org/docs/profiles/.

• unspecified
• key-compromise
• ca-compromise
• affiliation-changed
• superseded
• cessation-of-operation
• certificate-hold
• remove-from-crl
• privilege-withdrawn
• aa-compromise

Defines a TLS challenge to use in fulfilling the request.

Only one of http_challenge, http_webroot_challenge, http_s3_challenge and http_memcached_challenge can be defined at once. See the section on Using HTTP and TLS challenges for more details on using these and tls_challenge.

Controls the timeout in seconds for certificate requests that are made after challenges are complete. Defaults to 30 seconds.

As mentioned, cert_timeout does nothing until all challenges are complete. If you are looking to control timeouts related to a particular challenge (such as a DNS challenge), see that challenge provider's specific options.

A pre-created certificate request, such as one from [tls_cert_request][tls-cert-request], or one from an external source, in PEM format. Forces a new resource when changed.

One of common_name, subject_alternative_names, or certificate_request_pem must be specified. certificate_request_pem conflicts with common_name and subject_alternative_names; You cannot have certificate_request_pem defined at the same time as common_name or subject_alternative_names, and vice versa. Finally, common_name can be blank while subject_alternative_names is defined, and vice versa; in this case with the classic Let's Encrypt profile, the first domain defined in subject_alternative_names becomes the common name.

Disable the requirement for full propagation of the TXT challenge records before proceeding with validation. Defaults to false.

See About DNS propagation checks for details on the recursive_nameservers and disable_complete_propagation settings.

Enables the OCSP Stapling Required TLS Security Policy extension. Certificates with this extension must include a valid OCSP Staple in the TLS handshake for the connection to succeed. Defaults to false. Note that this option has no effect when using an external CSR - it must be enabled in the CSR itself. Forces a new resource when changed.

OCSP stapling requires specific webserver configuration to support the downloading of the staple from the CA's OCSP endpoints, and should be configured to tolerate prolonged outages of the OCSP service. Consider this when using must_staple, and only enable it if you are sure your webserver or service provider can be configured correctly.

Insert a delay after every DNS challenge record to allow for extra time for DNS propagation before the certificate is requested. Use this option if you observe issues with requesting certificates even when DNS challenge records get added successfully. Units are in seconds. Defaults to 0 (no delay).

Be careful with pre_check_delay since the delay is executed per-domain. Take your expected delay and divide it by the number of domains you have configured (common_name + subject_alternative_names).

The common name of the root of a preferred alternate certificate chain offered by the CA. The certificates in issuer_pem will reflect the chain requested, if available, otherwise the default chain will be provided. Forces a new resource when changed.

preferred_chain can be used to request alternate chains on Let's Encrypt during the transition away from their old cross-signed intermediates. See this article for more details. In their example titled "What about the alternate chain?", the root you would put in to the preferred_chain field would be ISRG Root X1. The equivalent in the staging environment is (STAGING) Pretend Pear X1.

The ACME profile to use when requesting the certificate. This can be used to control generation parameters according to the specific CA. The default is blank (no profile); forces a new resource when changed.

Let's Encrypt publishes details on their profiles at https://letsencrypt.org/docs/profiles/.

• unspecified
• key-compromise
• ca-compromise
• affiliation-changed
• superseded
• cessation-of-operation
• certificate-hold
• remove-from-crl
• privilege-withdrawn
• aa-compromise

Defines a TLS challenge to use in fulfilling the request.

Only one of http_challenge, http_webroot_challenge, http_s3_challenge and http_memcached_challenge can be defined at once. See the section on Using HTTP and TLS challenges for more details on using these and tls_challenge.

Controls the timeout in seconds for certificate requests that are made after challenges are complete. Defaults to 30 seconds.

As mentioned, cert_timeout does nothing until all challenges are complete. If you are looking to control timeouts related to a particular challenge (such as a DNS challenge), see that challenge provider's specific options.

A pre-created certificate request, such as one from [tls_cert_request][tls-cert-request], or one from an external source, in PEM format. Forces a new resource when changed.

One of common_name, subject_alternative_names, or certificate_request_pem must be specified. certificate_request_pem conflicts with common_name and subject_alternative_names; You cannot have certificate_request_pem defined at the same time as common_name or subject_alternative_names, and vice versa. Finally, common_name can be blank while subject_alternative_names is defined, and vice versa; in this case with the classic Let's Encrypt profile, the first domain defined in subject_alternative_names becomes the common name.

Disable the requirement for full propagation of the TXT challenge records before proceeding with validation. Defaults to false.

See About DNS propagation checks for details on the recursive_nameservers and disable_complete_propagation settings.

Enables the OCSP Stapling Required TLS Security Policy extension. Certificates with this extension must include a valid OCSP Staple in the TLS handshake for the connection to succeed. Defaults to false. Note that this option has no effect when using an external CSR - it must be enabled in the CSR itself. Forces a new resource when changed.

OCSP stapling requires specific webserver configuration to support the downloading of the staple from the CA's OCSP endpoints, and should be configured to tolerate prolonged outages of the OCSP service. Consider this when using must_staple, and only enable it if you are sure your webserver or service provider can be configured correctly.

Insert a delay after every DNS challenge record to allow for extra time for DNS propagation before the certificate is requested. Use this option if you observe issues with requesting certificates even when DNS challenge records get added successfully. Units are in seconds. Defaults to 0 (no delay).

Be careful with pre_check_delay since the delay is executed per-domain. Take your expected delay and divide it by the number of domains you have configured (common_name + subject_alternative_names).

The common name of the root of a preferred alternate certificate chain offered by the CA. The certificates in issuer_pem will reflect the chain requested, if available, otherwise the default chain will be provided. Forces a new resource when changed.

preferred_chain can be used to request alternate chains on Let's Encrypt during the transition away from their old cross-signed intermediates. See this article for more details. In their example titled "What about the alternate chain?", the root you would put in to the preferred_chain field would be ISRG Root X1. The equivalent in the staging environment is (STAGING) Pretend Pear X1.

The ACME profile to use when requesting the certificate. This can be used to control generation parameters according to the specific CA. The default is blank (no profile); forces a new resource when changed.

Let's Encrypt publishes details on their profiles at https://letsencrypt.org/docs/profiles/.

• unspecified
• key-compromise
• ca-compromise
• affiliation-changed
• superseded
• cessation-of-operation
• certificate-hold
• remove-from-crl
• privilege-withdrawn
• aa-compromise

Defines a TLS challenge to use in fulfilling the request.

Only one of http_challenge, http_webroot_challenge, http_s3_challenge and http_memcached_challenge can be defined at once. See the section on Using HTTP and TLS challenges for more details on using these and tls_challenge.

Controls the timeout in seconds for certificate requests that are made after challenges are complete. Defaults to 30 seconds.

As mentioned, cert_timeout does nothing until all challenges are complete. If you are looking to control timeouts related to a particular challenge (such as a DNS challenge), see that challenge provider's specific options.

A pre-created certificate request, such as one from [tls_cert_request][tls-cert-request], or one from an external source, in PEM format. Forces a new resource when changed.

One of common_name, subject_alternative_names, or certificate_request_pem must be specified. certificate_request_pem conflicts with common_name and subject_alternative_names; You cannot have certificate_request_pem defined at the same time as common_name or subject_alternative_names, and vice versa. Finally, common_name can be blank while subject_alternative_names is defined, and vice versa; in this case with the classic Let's Encrypt profile, the first domain defined in subject_alternative_names becomes the common name.

Disable the requirement for full propagation of the TXT challenge records before proceeding with validation. Defaults to false.

See About DNS propagation checks for details on the recursive_nameservers and disable_complete_propagation settings.

Enables the OCSP Stapling Required TLS Security Policy extension. Certificates with this extension must include a valid OCSP Staple in the TLS handshake for the connection to succeed. Defaults to false. Note that this option has no effect when using an external CSR - it must be enabled in the CSR itself. Forces a new resource when changed.

OCSP stapling requires specific webserver configuration to support the downloading of the staple from the CA's OCSP endpoints, and should be configured to tolerate prolonged outages of the OCSP service. Consider this when using must_staple, and only enable it if you are sure your webserver or service provider can be configured correctly.

Insert a delay after every DNS challenge record to allow for extra time for DNS propagation before the certificate is requested. Use this option if you observe issues with requesting certificates even when DNS challenge records get added successfully. Units are in seconds. Defaults to 0 (no delay).

Be careful with pre_check_delay since the delay is executed per-domain. Take your expected delay and divide it by the number of domains you have configured (common_name + subject_alternative_names).

The common name of the root of a preferred alternate certificate chain offered by the CA. The certificates in issuer_pem will reflect the chain requested, if available, otherwise the default chain will be provided. Forces a new resource when changed.

preferred_chain can be used to request alternate chains on Let's Encrypt during the transition away from their old cross-signed intermediates. See this article for more details. In their example titled "What about the alternate chain?", the root you would put in to the preferred_chain field would be ISRG Root X1. The equivalent in the staging environment is (STAGING) Pretend Pear X1.

The ACME profile to use when requesting the certificate. This can be used to control generation parameters according to the specific CA. The default is blank (no profile); forces a new resource when changed.

Let's Encrypt publishes details on their profiles at https://letsencrypt.org/docs/profiles/.

• unspecified
• key-compromise
• ca-compromise
• affiliation-changed
• superseded
• cessation-of-operation
• certificate-hold
• remove-from-crl
• privilege-withdrawn
• aa-compromise

Defines a TLS challenge to use in fulfilling the request.

Only one of http_challenge, http_webroot_challenge, http_s3_challenge and http_memcached_challenge can be defined at once. See the section on Using HTTP and TLS challenges for more details on using these and tls_challenge.

Controls the timeout in seconds for certificate requests that are made after challenges are complete. Defaults to 30 seconds.

As mentioned, cert_timeout does nothing until all challenges are complete. If you are looking to control timeouts related to a particular challenge (such as a DNS challenge), see that challenge provider's specific options.

A pre-created certificate request, such as one from [tls_cert_request][tls-cert-request], or one from an external source, in PEM format. Forces a new resource when changed.

One of common_name, subject_alternative_names, or certificate_request_pem must be specified. certificate_request_pem conflicts with common_name and subject_alternative_names; You cannot have certificate_request_pem defined at the same time as common_name or subject_alternative_names, and vice versa. Finally, common_name can be blank while subject_alternative_names is defined, and vice versa; in this case with the classic Let's Encrypt profile, the first domain defined in subject_alternative_names becomes the common name.

Disable the requirement for full propagation of the TXT challenge records before proceeding with validation. Defaults to false.

See About DNS propagation checks for details on the recursive_nameservers and disable_complete_propagation settings.

Enables the OCSP Stapling Required TLS Security Policy extension. Certificates with this extension must include a valid OCSP Staple in the TLS handshake for the connection to succeed. Defaults to false. Note that this option has no effect when using an external CSR - it must be enabled in the CSR itself. Forces a new resource when changed.

OCSP stapling requires specific webserver configuration to support the downloading of the staple from the CA's OCSP endpoints, and should be configured to tolerate prolonged outages of the OCSP service. Consider this when using must_staple, and only enable it if you are sure your webserver or service provider can be configured correctly.

Insert a delay after every DNS challenge record to allow for extra time for DNS propagation before the certificate is requested. Use this option if you observe issues with requesting certificates even when DNS challenge records get added successfully. Units are in seconds. Defaults to 0 (no delay).

Be careful with pre_check_delay since the delay is executed per-domain. Take your expected delay and divide it by the number of domains you have configured (common_name + subject_alternative_names).

The common name of the root of a preferred alternate certificate chain offered by the CA. The certificates in issuer_pem will reflect the chain requested, if available, otherwise the default chain will be provided. Forces a new resource when changed.

preferred_chain can be used to request alternate chains on Let's Encrypt during the transition away from their old cross-signed intermediates. See this article for more details. In their example titled "What about the alternate chain?", the root you would put in to the preferred_chain field would be ISRG Root X1. The equivalent in the staging environment is (STAGING) Pretend Pear X1.

The ACME profile to use when requesting the certificate. This can be used to control generation parameters according to the specific CA. The default is blank (no profile); forces a new resource when changed.

Let's Encrypt publishes details on their profiles at https://letsencrypt.org/docs/profiles/.

• unspecified
• key-compromise
• ca-compromise
• affiliation-changed
• superseded
• cessation-of-operation
• certificate-hold
• remove-from-crl
• privilege-withdrawn
• aa-compromise

Defines a TLS challenge to use in fulfilling the request.

Only one of http_challenge, http_webroot_challenge, http_s3_challenge and http_memcached_challenge can be defined at once. See the section on Using HTTP and TLS challenges for more details on using these and tls_challenge.

The proxy header to match against. Default: Host.

The proxy_header option behaves differently depending on its definition:

• When set to Host, standard host header validation is used.
• When set to Forwarded, the server looks in the Forwarded header for a section matching host=DOMAIN where DOMAIN is the domain currently being resolved by the challenge. See RFC 7239 for more details.
• When set to an arbitrary header (example: X-Forwarded-Host), that header is checked for the host entry in the same way the host header would normally be checked.

The proxy header to match against. Default: Host.

The proxy_header option behaves differently depending on its definition:

• When set to Host, standard host header validation is used.
• When set to Forwarded, the server looks in the Forwarded header for a section matching host=DOMAIN where DOMAIN is the domain currently being resolved by the challenge. See RFC 7239 for more details.
• When set to an arbitrary header (example: X-Forwarded-Host), that header is checked for the host entry in the same way the host header would normally be checked.

The proxy header to match against. Default: Host.

The proxy_header option behaves differently depending on its definition:

• When set to Host, standard host header validation is used.
• When set to Forwarded, the server looks in the Forwarded header for a section matching host=DOMAIN where DOMAIN is the domain currently being resolved by the challenge. See RFC 7239 for more details.
• When set to an arbitrary header (example: X-Forwarded-Host), that header is checked for the host entry in the same way the host header would normally be checked.

The proxy header to match against. Default: Host.

The proxy_header option behaves differently depending on its definition:

• When set to Host, standard host header validation is used.
• When set to Forwarded, the server looks in the Forwarded header for a section matching host=DOMAIN where DOMAIN is the domain currently being resolved by the challenge. See RFC 7239 for more details.
• When set to an arbitrary header (example: X-Forwarded-Host), that header is checked for the host entry in the same way the host header would normally be checked.

The proxy header to match against. Default: Host.

The proxy_header option behaves differently depending on its definition:

• When set to Host, standard host header validation is used.
• When set to Forwarded, the server looks in the Forwarded header for a section matching host=DOMAIN where DOMAIN is the domain currently being resolved by the challenge. See RFC 7239 for more details.
• When set to an arbitrary header (example: X-Forwarded-Host), that header is checked for the host entry in the same way the host header would normally be checked.