Daniel Nashed's Blog

Two Open Source ACME Servers Tested with HCL Domino CertMgr

HCL Domino CertMgr supports the ACME protocol for automated certificate management. While most deployments use public certificate authorities such as Let's Encrypt, ACME can also be used with private certificate authorities.
I recently tested two interesting open-source ACME server projects with HCL Domino CertMgr. Both worked successfully, but they take very different approaches.


acme-ca-server – A Python-Based Private ACME CA

GitHub: https://github.com/knrdl/acme-ca-server

The first project, acme-ca-server, is a Python-based ACME server with an integrated Certificate Authority and PostgreSQL backend.
It provides a relatively straightforward way to set up a private ACME endpoint using Docker.
For my tests, I deployed the server with PostgreSQL 17 behind an NGINX reverse proxy. After configuring the database connection, CA keys and external URL correctly, HCL Domino CertMgr was able to request and obtain certificates.

The project currently supports HTTP-01 validation, but not DNS-01.

The implementation works, but I would not consider it production-ready without additional work.
In particular, CA private key protection deserves more attention. A CA signing key is one of the most sensitive components of a PKI, and protecting it requires more than simply storing it in a container or database.
There are also operational and security aspects that would need to be reviewed before using this implementation in a production environment.
Nevertheless, the project demonstrates that a relatively small, independent ACME CA can interoperate successfully with Domino CertMgr.

go-acme-server – A Flexible ACME Foundation Written in Go

GitHub: https://github.com/misiektoja/go-acme-server
Documentation: https://misiektoja.github.io/go-acme-server/

The second project is particularly interesting.
Unlike a traditional standalone ACME CA, go-acme-server is designed as an embeddable Go library implementing the ACME protocol.
It separates ACME protocol handling from the actual Certificate Authority implementation.
This is a very attractive architecture because it allows developers to build virtually any kind of CA integration on top of the ACME protocol.

The library provides functionality for:

• ACME account and order management
• HTTP-01, DNS-01 and TLS-ALPN-01 challenges
• Certificate issuance and revocation interfaces
• Custom CA implementations
• Custom storage backends
• Integration with external services and approval workflows
   

The project also includes a quickstart example with a small embedded CA.
I extended this example with configurable listening addresses, an external ACME BaseURL, support for operation behind NGINX, real DNS resolution and DNS-01 validation.
With these relatively small changes, HCL Domino CertMgr successfully worked with the Go implementation as well, including DNS-01 challenges.
The example CA is intentionally temporary and uses in-memory storage. It is a development starting point rather than a production CA.

Why Go Makes This Particularly Interesting

Go is a modern programming language that is particularly well suited for network services and security-sensitive infrastructure.
It offers several advantages:

• Memory safety through managed memory and bounds checking
• A strong standard library, including TLS and X.509 cryptography
• Native concurrency and efficient network handling
• Small, self-contained binaries
• Straightforward container deployment
• Good cross-platform support
• A relatively small operational footprint
   

Of course, secure implementation and proper key management remain essential regardless of programming language.
But Go provides a very solid foundation for building a modern ACME service.

Beyond a Standalone CA

The real potential of go-acme-server is its extensibility.
The ACME server does not need to implement all CA functionality itself. Instead, certificate issuance can be delegated to a custom backend.
For example, an implementation could integrate with:

• An existing enterprise PKI
• A hardware security module (HSM)
• A custom certificate signing service
• An approval workflow
• An internal certificate inventory
• HCL Domino applications and services

For Domino environments, this opens up interesting possibilities.

A Domino application could manage certificate requests, approval policies, auditing and certificate inventory, while the Go service handles the ACME protocol and delegates signing to an appropriate CA backend.
Alternatively, a lightweight CA could be implemented directly in Go using its standard cryptographic libraries.
This makes the project much more than another ACME server. It provides a reusable foundation for building custom certificate management solutions.


Conclusion

Both open-source projects successfully interoperated with HCL Domino CertMgr in my tests.
The Python-based acme-ca-server demonstrates that a small private ACME CA can work with Domino, although additional security and operational work would be necessary before considering production deployment.

The Go-based go-acme-server is the more interesting project from an architectural perspective.
Its modular design makes it possible to integrate the ACME protocol with almost any certificate authority or PKI workflow.

Combined with Go's modern development model, security-oriented standard libraries and lightweight deployment options, this provides an excellent starting point for building custom ACME infrastructure.
For me, this is the most interesting outcome of the tests: ACME can be used not only to connect Domino CertMgr to existing certificate providers, but also as a standardized interface for entirely new PKI integrations.
Both projects are worth exploring, particularly for anyone interested in private PKI and automated certificate management.

• Comments [0]