Question
Which ACME validation method is most reliable for Proxmox VE clusters with split-horizon DNS?
Cig Orbit
0 reputation · 30 Apr 2020, 02:14 UTC
48.8K views1
Loading…
0 reputation · 30 Apr 2020, 02:14 UTC
Proxmox VE utilizes the pveproxy service to handle ACME Let's Encrypt certificate automation, typically relying on HTTP-01 validation via port 80. For cluster environments, the node name must align with the certificate Subject Alternative Names (SANs) to ensure seamless web UI access and API communication across all members.
In scenarios where split-horizon DNS is implemented, internal resolution for cluster nodes may differ from the public records used by the ACME CA. Because Proxmox VE's native integration focuses on HTTP-01 challenges, there is an operational uncertainty regarding how to maintain automated renewals when public DNS cannot reach specific internal nodes or when internal resolvers prevent the node from validating its own public FQDN.
What are the implications of using a reverse proxy to centralize ACME challenges versus managing certificates manually on each node? Does Proxmox VE 8.x provide a mechanism to transition to DNS-01 validation to bypass the requirement for port 80 accessibility?
The most reliable ACME validation method for Proxmox VE clusters operating with split-horizon DNS is DNS-01. Unlike HTTP-01, which requires the Certificate Authority (CA) to reach the node via port 80, DNS-01 validates domain ownership by verifying a TXT record in your public DNS zone, completely bypassing the need for inbound network access to internal cluster nodes.
In a split-horizon setup, the public DNS record for a node may point to a gateway or not exist at all, while internal DNS points to a private IP. This creates two primary failures for HTTP-01:
DNS-01 resolves this by shifting the proof of ownership from the network layer (reachability) to the administrative layer (DNS control). This allows Proxmox VE to obtain certificates for nodes that are entirely isolated from the public internet.
Proxmox VE 8.x provides native support for DNS-01 validation via API integrations with various DNS providers. This removes the requirement for port 80 accessibility and enables the use of wildcard certificates, which can simplify management across multiple nodes.
proxmoxDatacenter > ACME and register an account with your chosen CA (e.g., Let's Encrypt).This recommendation assumes that you have administrative access to a DNS provider with a supported API. If your DNS provider does not support API-driven updates, DNS-01 cannot be automated within Proxmox VE.
Security Note: Using DNS-01 requires storing DNS API keys within the Proxmox cluster. Ensure these keys are scoped with the minimum necessary permissions (only allowing the creation/deletion of specific TXT records) to limit risk.
To confirm if this is the only viable path, please specify: Does your public DNS provider offer a REST API for record management? If not, you may be forced to use a manual certificate process or a separate ACME client (like Certbot) on a gateway machine.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.