Daniel Nashed's Blog

Actalis Free Italian ACME CA for single host certificates

Today I was looking for an European based ACME provider since Buypass stopped their free services.
ChatGPT found exactly one provider: Actalis.

I took a quick look and registered an account.

They offer free and commercial services. The free trier supports the usual 90 days certificates.
In contrast to Let's Encrypt they have the following limitations for fee certificates. But that is perfectly OK for CertMgr when automating certificate requests.

• 90 Days. for ACME certs (commercial certs are also available for 1 year)
• Only single hosts (not just single domain)
• No wild card certs (which would require DNS-01 challenges)
• As usual ACME certs are only validating the DNS name. Not the organization
• ACME requires registering a free account and to use EAB as part of the ACME configuration (see screen shot below, it's part of your free account)

Here is how it looks like. It's a bit more configuration work then for Let's Encrypt.
But I think it is good to have a second option for certificates -- specially when it is an European provider.
Take a look at the commercial options as well. They might be a good choice too.

You need to import the trusted root. ACME providers and other CAs don't send the root.
Only the certificate chain with the leaf and the intermediate certs. The root must be in your trust store (in this case certstore.nsf trusted roots).

How to find the root certificate?

Usually the root is referenced in the certificate:

AuthInfoURL: http://cacert.actalis.it/certs/actalis-autroot

The certificate is in DER format. So you need to convert it to PEM.

curl -s http://cacert.actalis.it/certs/actalis-autroot | openssl x509 -inform DER

You find the certificate also in the Domino directory and cacert.pem in the Domino directory on client and server.



Website:

https://www.actalis.com

ACME Account URL:

https://acme-api.actalis.com/acme/directory

ACME error for multiple hosts:

Here is the error you get when requesting multiple certs:
Error  Your account only grants single-domain 90-days DV certificates (400).

For single hosts this works perfectly fine.

• Comments [0]