Help Centre
Home SSL Certificates General Information About SSL Certificates

Setting up IONOS SSL certificates on servers using the ACME protocol

Article translated by machine

This text is a machine translation. A revised version is planned.

For IONOS server products running Linux or Windows

The ACME (Automatic Certificate Management Environment) protocol is used for the automatic issuance and management of SSL/TLS certificates. In this article, you will learn how to set up SSL certificates on your server via the IONOS ACME server. The setup procedure is described for Linux systems using Certbot and for Windows systems using win-acme.

Note

The IONOS ACME server currently supports Domain Validation (DV) certificates only. OV and EV certificates cannot currently be issued via ACME.

Requirements

To use the ACME interface provided by IONOS, the following prerequisites must be met:

  • You need root or sudo privileges on your Linux system, or administrator access to your Windows server, for example via RDP.

  • Your domain uses IONOS’s name servers.

  • An available DV certificate must be present in your IONOS account. This can be either a free or a paid DV certificate.

  • The domain for which the certificate is to be issued points to your server’s public IP address via an A or AAAA record.

  • The server is accessible from the internet.

  • If you are using Certbot with the Nginx or Apache plugin, the relevant web server must be correctly installed and configured.

  • If you are using win-acme with IIS, a suitable IIS website or IIS binding should already exist for the desired domain.

Step 1: Generate an External Account Binding (EAB)

Before you can issue a certificate via the IONOS ACME server, you must first set up the relevant login details in your IONOS account.

  • Go to the SSL management section in your IONOS account.
  • In the right-hand navigation pane, click the ACME External Account Bindings link.
  • Click the Create Account button .
  • Enter the desired account name in the relevant field and click Next.
  • Make a note of the displayed Key ID and the HMAC key.
  • Tick the checkbox I have copied the HMAC key and click Got it!.

Please note

For security reasons, the HMAC key is only displayed once when it is generated. Keep the key ID and the HMAC key in a safe place . Do not disclose this information to third parties and do not store it unprotected in scripts or publicly accessible files.

Step 2: Install the client and obtain a certificate

Note

If you are already using a manually installed certificate for your domain and now wish to switch to ACME, please have the certificate reissued via the client once. We strongly recommend that you create a backup of your current web server configuration beforehand.

The next steps vary depending on the operating system:

  • Linux: Set-up with Certbot
  • Windows: Set up with win-acme
Option A: Set-up on Linux servers (Certbot)

Install Certbot and the appropriate plug-in for your web server in accordance with the official Certbot guide (https://certbot.eff.org/).

Then log in to your Linux server via SSH.

In the following commands, replace example.com with your domain and $eab_kid and $eab_key with the data generated in step 1.

Note

The parameter -m "" refers to the email address, which is not actively used by the IONOS ACME server and can therefore be left blank.

Example for Nginx

certbot --nginx \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Example for Apache

certbot --apache \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Standalone mode

Select this mode if you simply wish to download the certificate without Certbot interfering with your web server’s configuration.

certbot certonly --standalone \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Once the certificate has been successfully issued, you will usually find the certificate files at:

/etc/letsencrypt/live/example.com/

Important files are:

fullchain.pem
privkey.pem

If you are using standalone mode, you will then need to manually incorporate these files into your web server’s configuration.

Option B: Set-up on Windows servers using win-acme

On Windows servers, you can use win-acme. When used with IIS, win-acme can request and install certificates and automatically update IIS bindings.

Interactive setup

  • Open PowerShell as an administrator.
  • Navigate to the directory containing wacs.exe

  • To start win-acme in interactive mode with the IONOS ACME server, run the following command:

    .\wacs.exe --baseuri https://acme.ionos.com

  • From the win-acme menu, select the option N: Create Certificate (default options).
  • Then select your website or the desired IIS binding.
  • When win-acme asks for the key identifier and the key, enter the key ID and HMAC key you created earlier.

The win-acme tool will now request the certificate, install it and automatically adjust the configuration for the IIS binding.

Alternative: Set-up via PowerShell command

You can also initiate the issuance directly via PowerShell:

./wacs.exe --source iis --installation iis `
--baseuri https://acme.ionos.com/ `
--host test-cloud-hosting2.de `
--eab-key-identifier YOUR_KEY_ID `
--eab-key YOUR_HMAC_KEY `
--emailaddress “”

Note

The parameter --emailaddress "" refers to the email address, which is not actively used by the IONOS ACME server and can therefore be left blank.

Check the setup

Once the certificate has been successfully issued, it will be marked with the label ‘ACME’ in your IONOS SSL management console.

Testing on Linux

You can use Certbot to view the managed certificates:

certbot certificates

Then open your website in your browser:

https://example.com

Alternatively, you can check the certificate using OpenSSL:

openssl s_client -connect example.com:443 -servername example.com

Check for automatic renewal

A key advantage of ACME is the automatic renewal of certificates. Certbot can manage certificates, monitor their expiry dates and renew them.

Automatic renewal on Linux

Depending on the installation method, Certbot sets up either a systemd timer or a cron job.

On systemd-based distributions, check whether a Certbot timer is present.

systemctl list-timers | grep -i certbot

You can test the renewal using the following command:

certbot renew --dry-run

Automatic renewal on Windows

win-acme usually creates a scheduled task in the Windows Task Scheduler. This task carries out the renewal automatically. win-acme uses the --renew parameter for scheduled renewals.

You can view existing renewal configurations using the following command:

.\wacs.exe --list --baseuri "https://acme.ionos.com"

You should also check in the Windows Task Scheduler to ensure that a Win-ACME task is present and enabled.

Further information

Further information on Certbot and win-acme can be found in the official documentation:

Content