How to Install an ACME SSL on TrueNAS?

Installing your ACME SSL certificate on TrueNAS is essential to provide access to TrueNAS web interface and HTTPS-enabled services in a secure manner.

While TrueNAS features certificate management natively, clients wishing to acquire ACME certificates from commercial providers must resort to using a third-party ACME client, such as acme.sh. This is necessary in cases where the authority also requires External Account Binding (EAB).

This guide illustrates the process of receiving an ACME SSL certificate using acme.sh, completing DNS-01 validation, importing the certificate into TrueNAS, and automatically renewing and deploying the certificate.

Prerequisites

Before starting the process described below, please ensure that you have the following:

• A fully qualified domain name pointing to your TrueNAS system (for example, nas.example.com)
• TrueNAS CORE or TrueNAS SCALE
• External Linux or BSD machine, VPS or home server to run the ACME client
• ACME-enabled account provided by commercial certificate authority
• ACME Directory URL given by the CA
• EAB Key ID (KID) when mandated by the CA
• EAB HMAC Key when mandated by the CA
• Access to the DNS provider for performing DNS-01 validation
• SSH access to TrueNAS in case certificate deployment needs to be automated

The external ACME host is responsible for the processes of generating and renewing the certificate. After that, TrueNAS is able to either import the issued certificates automatically or manually.

How to Install an ACME SSL Certificate on TrueNAS?

Step 1: Install acme.sh on Your External Host

The external ACME host is responsible for creating the ACME account and taking care of the processes of issuing and renewing certificates.

Run:

source ~/.bashrc
acme.sh --version

If the version prints correctly, you’re good.

Step 2: Register Your ACME Account with Your Commercial CA (ACME + EAB)

Your CA dashboard will provide:

• EAB Key ID
• EAB HMAC Key
• ACME Directory URL

Register your ACME account:

acme.sh --register-account \
  --server https://acme.yourca.com/v2/acme \
  --eab-kid YOUR_EAB_KID \
  --eab-hmac-key YOUR_EAB_HMAC_KEY \
  --accountemail [email protected]

Replace values with your own. You only run this once.

Step 3: Issue the Certificate (DNS-01 Validation Required)

TrueNAS is almost always behind NAT, so DNS validation is the safest.

Here’s a manual DNS example:

acme.sh --issue \
  -d nas.example.com \
  --dns dns_manual \
  --server https://acme.yourca.com/v2/acme

acme.sh will tell you to create a TXT record:

_acme-challenge.nas.example.com   TXT   <token>

Create the TXT record in your DNS manager and wait for propagation.

Check propagation:

dig TXT _acme-challenge.nas.example.com +short

Once the token appears, re-run the same command and acme.sh will finish issuing the certificate. Your files will be saved at ~/.acme.sh/nas.example.com/.

Inside you’ll find:

• fullchain.cer: server cert + intermediate
• nas.example.com.key: private key
• ca.cer: CA chain (if provided separately)

Step 4: Import the Certificate into TrueNAS

• Go to: TrueNAS UI > System > Certificates
• Click Add and select Import Certificate
• Upload your certificate files and click Save

Assign the certificate to your services:

• Web UI
• SMB / NFS services (if applicable)
• Middleware APIs
• Reverse proxies or apps using HTTPS (TrueNAS SCALE)

Step 5: Automate Renewal and Deployment

TrueNAS does not auto-pull certificates. You must push renewed certificates into TrueNAS.

1. Create a Deploy Script:

On your external ACME host, create /usr/local/bin/truenas-deploy.sh:

Note: This script works only if TrueNAS allows SSH access with a user permitted to run midclt. It uploads the new key + cert to /tmp/ and replaces the active certificate through the TrueNAS API. Make sure your paths and domain match your acme.sh setup.

#!/bin/bash
DOMAIN="nas.example.com"
NAS_USER="root"
NAS_HOST="truenas.local"
CERT_PATH="$HOME/.acme.sh/$DOMAIN"
KEY="$CERT_PATH/$DOMAIN.key"
CERT="$CERT_PATH/fullchain.cer"
scp "$KEY" "$NAS_USER@$NAS_HOST:/tmp/key.key"
scp "$CERT" "$NAS_USER@$NAS_HOST:/tmp/cert.cer"
ssh "$NAS_USER@$NAS_HOST" <<EOF
midclt call certificate.update '{"certificate": "custom", "csr": null, "privatekey": "$(cat /tmp/key.key)", "certificate": "$(cat /tmp/cert.cer)"}'
EOF>>

Make it executable:

chmod +x /usr/local/bin/truenas-deploy.sh

2. Add a Renewal Hook:

Add a deploy hook in acme.sh:

acme.sh --deploy-hook truenas-deploy \
  -d nas.example.com

Or add this inside ~/.acme.sh/deploy/truenas-deploy.sh.

3. Let acme.sh handle everything

Here’s what acme.sh does automatically:

• Performs checks to see if the certificate is due for renewal once every 24 hours.
• Renew the certificate.
• Triggers the deployment script.
• Updates the certificate in TrueNAS.
• Makes changes without any kind of interruption.

Once configured, you don’t have to touch TrueNAS again for cert renewals.

Conclusion

Are you searching for a trustworthy ACME SSL certificate for your TrueNAS setup? CheapSSLWEB provides wallet-friendly Automated SSL certificate options and certificate solutions to assist companies in securing their websites, servers and network infrastructure.

Check the choices now and select the ideal SSL certificate for your requirements related to security and automation.