github
/
acme4j
mirror of https://github.com/shred/acme4j
1
0
Fork 0
Code Issues Releases Wiki Activity

Document how to use different Pebble domain (#160)

pull/168/head
Richard Körber 2024-08-22 20:18:07 +02:00
parent e589b16d98
commit afa60ae76f
No known key found for this signature in database
GPG Key ID: AAB9FD19C78AA3E0
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/doc/docs/ca/pebble.md
View File

@ -12,3 +12,22 @@ This ACME provider can be used to connect to a local Pebble server instance, mai
* `acme://pebble/pebble.example.com:12345` - Connect to a Pebble server at `pebble.example.com` and port 12345.
Pebble uses a self-signed certificate for HTTPS connections. The Pebble provider accepts this certificate.
## Different Host Name
The Pebble server provides an end-entity certificate for the `localhost` and `pebble` domain.
If your Pebble server can be reached at a different domain (like `pebble.example.com` above), you need to create a correct end-entity certificate on your Pebble server. [See here](https://github.com/letsencrypt/pebble/tree/main/test/certs) for how to use `minica` to create a matching certificate.
Otherwise you will get an `AcmeNetworkException: Network error` that is caused by a `java.io.IOException: No subject alternative DNS name matching [...] found` when trying to access the Pebble server.
If you cannot create a correct end-entity certificate on your Pebble server, you could also disable host name verification on Java side: `-Djdk.internal.httpclient.disableHostnameVerification`
!!! warning
**Disable hostname verification for testing purposes only, never in a production environment!** Create a correct end-entity certificate whenever possible.
## Custom CA Certificate
Pebble provides a default CA certificate, which can be found at `test/certs/pebble.minica.pem` of the Pebble server. This default CA is integrated into _acme4j_'s Pebble provider, and is automatically accepted.
If you run a Pebble instance with a custom `pebble.minica.pem`, copy your PEM file as a resource to your project (either in the `src/test/resources` or `src/test/resources/META-INF` folder).