ACME
Defines a TLS profile that obtains and renews certificates automatically via Let's Encrypt (ACME). Utilizes Go's built-in autocert module under the hood.
Only usable for server.encrypt.tls.
|
Description
Using this profile means agreeing to the Let’s Encrypt terms of service. The ACME challenge requires setting server.encrypt.httpport.
When running more than one instance, point Cache at a directory they all share so each instance doesn’t request its own certificate and run into Let’s Encrypt rate limits.
Certificates renew on their own. Changes to this profile’s parameters can be reloaded. Hosts that are added get their certificate on the first connection, and certificates for hosts that are removed stop renewing. Changing Cache starts from an empty directory unless you move its contents, which means requesting new certificates.
Example
-
YAML
-
JSON
tls:
- name: acme
id: public
hosts:
- tiles.example.com
cache: /var/lib/tilegroxy/certs{
"tls": [
{
"name": "acme",
"id": "public",
"hosts": [
"tiles.example.com"
],
"cache": "/var/lib/tilegroxy/certs"
}
]
}Configuration
| Parameter | Description | Type | Required | Default |
|---|---|---|---|---|
|
The unique identifier of the profile used to reference this profile elsewhere in configuration. |
string |
Yes |
None |
|
The minimum TLS version to allow. Can be |
string |
No |
1.2 |
|
The hosts to obtain certificates for and to redirect to. Each must be a valid hostname. Wildcards aren’t supported |
string[] |
Yes |
None |
|
The path to a directory to cache certificates in |
string |
No |
./certs |