Setting Up IONOS SSL Certificates on Servers Using the ACME Protocol

For IONOS server products running Linux or Windows

The ACME (Automatic Certificate Management Environment) protocol is used for the automatic issuance and management of SSL/TLS certificates. In this article, you’ll learn how to set up SSL certificates on your server using the IONOS ACME server. The setup process is described for Linux systems using Certbot and for Windows systems using win-acme.

Requirements

To use the IONOS ACME interface, the following requirements must be met:

• You need root or sudo privileges on your Linux system or administrator access to your Windows server, for example via RDP.

• Your domain uses IONOS’s nameservers.

• An available DV certificate must be present in your IONOS account. This can be either a free or paid DV certificate.

• The domain for which the certificate is to be issued points to your server’s public IP address via an A or AAAA record.

• The server is accessible from the Internet.

• If you’re using Certbot with the Nginx or Apache plugin, the respective web server must be correctly installed and configured.

• If you are using win-acme with IIS, a suitable IIS website or IIS binding should already exist for the desired domain.

Step 1: Generate an External Account Binding (EAB)

Before you can issue a certificate via the IONOS ACME server, you must first create the appropriate login credentials in your IONOS account.

• Go to the SSL management section in your IONOS account.
• In the right-hand navigation pane, click the ACME External Account Bindings link.
• Click the " Create Account" button .
• Enter the desired account name in the corresponding field and click Next.
• Make a note of the displayed Key ID and the HMAC key.
• Check the box next to " I have copied the HMAC key " and click " Got it!".

Step 2: Install the client and obtain a certificate

The next steps vary depending on the operating system:

• Linux: Setup with Certbot
• Windows: Setup with win-acme

Option A: Setup on Linux Servers (Certbot)

Install Certbot and the appropriate plugin for your web server according to the official Certbot instructions (https://certbot.eff.org/).

Then log in to your Linux server via SSH.

In the following commands, replace example.com with your domain and $eab_kid and $eab_key with the data generated in Step 1.

Example for Nginx

certbot --nginx \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Example for Apache

certbot --apache \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Standalone Mode

Select this mode if you simply want to download the certificate without Certbot interfering with your web server's configuration.

certbot certonly --standalone \
--server https://acme.ionos.com/directory \
-m "" \
-d example.com \
--eab-kid $eab_kid \
--eab-hmac-key $eab_key

Once the certificate has been successfully issued, you can usually find the certificate files at:

/etc/letsencrypt/live/example.com/

Important files include:

fullchain.pem
privkey.pem

If you are using standalone mode, you must then manually include these files in your web server’s configuration.

Option B: Setup on Windows Servers Using win-acme

On Windows servers, you can use win-acme. When used with IIS, win-acme can request and install certificates and automatically update IIS bindings.

• Download win-acme from the official website: https://www.win-acme.com/
• Extract the archive on your Windows server.
  

Interactive Setup

• Open PowerShell as an administrator.
• Navigate to the directory where wacs.exe is located

• To start win-acme in interactive mode with the IONOS ACME server, run the following command:

  .\wacs.exe --baseuri https://acme.ionos.com

• From the win-acme menu, select N: Create Certificate (default options).
• Then select your website or the desired IIS binding.
• When win-acme prompts you for the key identifier and the key, enter the key ID and HMAC key you created earlier.

The win-acme tool will now request the certificate, install it, and automatically adjust the configuration for the IIS binding.

Alternative: Setup via PowerShell command

You can also initiate the issuance directly via PowerShell:

./wacs.exe --source iis --installation iis `
--baseuri https://acme.ionos.com/ `
--host test-cloud-hosting2.de `
--eab-key-identifier YOUR_KEY_ID `
--eab-key YOUR_HMAC_KEY `
--emailaddress “”

Check the setup

Once the certificate has been successfully issued, it will be marked with the "ACME " label in your IONOS SSL management console.

Checking on Linux

You can use Certbot to view the managed certificates:

certbot certificates

Then open your website in a browser:

https://example.com

Alternatively, you can verify the certificate using OpenSSL:

openssl s_client -connect example.com:443 -servername example.com

Check for Automatic Renewal

A key advantage of ACME is the automatic renewal of certificates. Certbot can manage certificates, monitor their expiration dates, and renew them.

Automatic Renewal on Linux

Depending on the installation method, Certbot sets up either a systemd timer or a cron job.

On systemd-based distributions, check whether a Certbot timer exists.

systemctl list-timers | grep -i certbot

You can test the renewal using the following command:

certbot renew --dry-run

Automatic Renewal in Windows

By default, win-acme creates a scheduled task in the Windows Task Scheduler. This task automatically performs the renewal. win-acme uses the --renew parameter for scheduled renewals.

You can view existing renewal configurations using the following command:

.\wacs.exe --list --baseuri "https://acme.ionos.com"

Also, check the Windows Task Scheduler to see if a Win-ACME task exists and is enabled.

More Information

For more information about Certbot and win-acme, see the official documentation:

• Certbot website: https://certbot.eff.org/
• Certbot documentation: https://eff-certbot.readthedocs.io/en/stable/index.html
• win-acme website: https://www.win-acme.com/