# Proxmox ACME Certificate Management - Quick Reference

**Date:** 2025-01-20  
**Status:** 📋 Quick Reference Guide  
**Purpose:** Quick commands and steps for ACME certificate management

---

## Quick Setup Checklist

- [ ] Create Cloudflare API token
- [ ] Configure ACME account in Proxmox
- [ ] Configure Cloudflare DNS plugin
- [ ] Test with staging environment
- [ ] Generate production certificates
- [ ] Apply certificates to services
- [ ] Monitor expiration

---

## Cloudflare API Token Creation

1. Go to: https://dash.cloudflare.com/profile/api-tokens
2. Click "Create Token"
3. Use "Edit zone DNS" template
4. Permissions: Zone → DNS → Edit
5. Zone Resources: All zones (or specific)
6. Copy token

---

## Proxmox Web UI Steps

### 1. Add ACME Account

**Location:** Datacenter → ACME → Accounts → Add

**Configuration:**
- Directory URL: `https://acme-v02.api.letsencrypt.org/directory` (Production)
- Email: your-email@example.com
- Accept Terms of Service

### 2. Add DNS Plugin

**Location:** Datacenter → ACME → DNS Plugins → Add

**Configuration:**
- Plugin: `cloudflare`
- API Token: Your Cloudflare API token

### 3. Generate Certificate

**Location:** Node → System → Certificates → ACME → Add

**Configuration:**
- Domain: your-domain.com
- ACME Account: Select your account
- DNS Plugin: Select cloudflare
- Challenge Type: DNS-01

---

## CLI Commands

### List ACME Accounts
```bash
pvesh get /cluster/acme/accounts
```

### List DNS Plugins
```bash
pvesh get /cluster/acme/plugins
```

### List Certificates
```bash
pvesh get /cluster/acme/certificates
```

### Add ACME Account (CLI)
```bash
pvesh create /cluster/acme/account \
  --directory-url https://acme-v02.api.letsencrypt.org/directory \
  --contact email@example.com
```

### Register Account
```bash
pvesh create /cluster/acme/account/account-name/register
```

### Generate Certificate (CLI)
```bash
pvesh create /cluster/acme/certificate \
  --account account-name \
  --domain example.com \
  --dns cloudflare \
  --plugin cloudflare
```

### Check Certificate Expiration
```bash
openssl x509 -in /etc/pve/nodes/<node>/pve-ssl.pem -noout -dates
```

---

## Certificate File Locations

### Node Certificates
- Certificate: `/etc/pve/nodes/<node>/pve-ssl.pem`
- Private Key: `/etc/pve/nodes/<node>/pve-ssl.key`

### ACME Configuration
- Accounts: `/etc/pve/priv/acme/`
- Certificates: `/etc/pve/nodes/<node>/`

---

## Troubleshooting

### Certificate Generation Fails

**Check:**
1. API token permissions
2. DNS resolution
3. Domain ownership
4. Rate limits (Let's Encrypt)
5. Logs: `/var/log/pveproxy/access.log`

### Renewal Fails

**Check:**
1. API token validity
2. DNS plugin configuration
3. Automatic renewal settings
4. Certificate expiration date

### Service Not Using Certificate

**Check:**
1. Certificate applied to node
2. Service configuration
3. Service restarted
4. Certificate file permissions

---

## Security Best Practices

✅ Use API Tokens (not Global API Key)  
✅ Limit token permissions  
✅ Store tokens securely  
✅ Test with staging first  
✅ Monitor expiration dates  
✅ Use strong key sizes  
✅ Enable HSTS where applicable  

---

## Useful Links

- [Full Plan Document](PROXMOX_ACME_CLOUDFLARE_PLAN.md)
- [Domain Inventory Template](./PROXMOX_ACME_DOMAIN_INVENTORY.md)
- [Proxmox ACME Docs](https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certificate_management)
- [Cloudflare API Docs](https://developers.cloudflare.com/api/)
- [Let's Encrypt Docs](https://letsencrypt.org/docs/)

---

**Last Updated:** 2025-01-20  
**Status:** 📋 Quick Reference
