In a production or homelab environment, managing SSL certificates across multiple internal services gets tedious fast. Putting your services behind pfSense with HAProxy and automating wildcard certificates through the pfSense ACME package gives you a clean, hands off setup.
In the previous post, we delegated acme.tadiosabebe.com from GoDaddy to deSEC and created a scoped API token that only has permission to write TXT records to _acme-challenge.acme.tadiosabebe.com. In this post, we’ll configure pfSense to use that token with DNS alias mode to issue a wildcard certificate for tadiosabebe.com and *.tadiosabebe.com, and automatically restart HAProxy whenever the certificate renews.
Registering Your Let’s Encrypt Account Key
First, make sure the acme package is installed on your pfSense firewall (System -> Package Manager -> Available Packages).
Once installed, go to Services -> ACME Certificates -> Account Keys and click Add to register your Let’s Encrypt account:
- Name:
LetsEncrypt - Description:
Let's Encrypt Production Account - ACME Server:
Let's Encrypt Production ACME v2 - E-Mail Address:
[email protected]
After filling in those details:
- Click Create new account key and wait for the key to populate in the text box.
- Click Register ACME account key and wait for confirmation.
- Click Save.
Configuring the Wildcard Certificate and Challenge Alias
Next, go to the Certificates tab (Services -> ACME Certificates -> Certificates) and click Add.
Set the general certificate name:
- Name:
tadios_wildcard - Description:
Wildcard certificate for tadiosabebe.com - ACME Account:
LetsEncrypt
Adding the Domain SAN List
Scroll down to the Domain SAN list section. Because we want the certificate to cover both the root domain (tadiosabebe.com) and all subdomains (*.tadiosabebe.com), we need to add two entries using the DNS-deSEC.io validation method and enable DNS alias mode so pfSense writes the TXT record to acme.tadiosabebe.com.
Configure the first entry for the root domain:
| Field | Value | What it means |
|---|---|---|
| Status | Enabled |
Includes this domain in the certificate |
| Domainname | tadiosabebe.com |
Root domain name |
| Method | DNS-deSEC.io |
Uses the deSEC API for DNS-01 validation |
| Token | YOUR_DEDYN_TOKEN |
Paste the scoped token secret we created in Part 1 |
| Name | acme-tadios-dns01 |
Your token name |
| Enable DNS alias mode | acme.tadiosabebe.com. |
Tells ACME to write the _acme-challenge record inside the delegated deSEC zone |
| Enable DNS domain alias mode | Unchecked |
Leave disabled since we mapped _acme-challenge directly via CNAME |
Click Add to create a second entry for the wildcard domain with the exact same settings, changing only the domain name:
- Status:
Enabled - Domainname:
*.tadiosabebe.com - Method:
DNS-deSEC.io - Token:
YOUR_DEDYN_TOKEN - Name:
acme-tadios-dns01 - Enable DNS alias mode:
acme.tadiosabebe.com. - Enable DNS domain alias mode:
Unchecked
Setting DNS Sleep and HAProxy Reload Actions
Scroll down below the SAN list to configure the wait time for DNS propagation and tell pfSense to reload HAProxy every time the certificate updates:
- DNS-Sleep: Set this to
120. This gives deSEC two minutes to propagate the newTXTrecord across its nameservers before Let’s Encrypt checks it. - Under Actions list, click Add and enter:
- Status:
Enabled - Command:
haproxy - Method:
Restart Local Service(This makes sure HAProxy picks up the new certificate automatically after renewal)
- Click Save at the bottom of the page.
Issuing the Certificate and Enabling Auto Renewal
Before issuing the certificate, make sure automatic renewal is turned on under Services -> ACME Certificates -> General Settings by checking the Cron Entry box and clicking Save. That sets up a daily cron job on pfSense to check and renew certificates before they expire.
Now go back to the Certificates tab, find the tadios_wildcard row, and click the Issue/Renew button.
After about two minutes once the 120 second DNS sleep finishes. Look for the final lines confirming the certificate was saved to the pfSense Certificate Manager and HAProxy restarted cleanly.
That’s it! Your pfSense firewall will now automatically issue and renew wildcard certificates for your internal services without ever exposing your main GoDaddy DNS zone.