Good afternoon, community! I’m completely new to TrueNAS and have run into an unexpected issue. I’m using version 25.10.4 SCALE, and I need to issue an SSL certificate using Let’s Encrypt — this functionality is implemented in the TrueNAS UI. But it seems to work only with DNS challege, while I need HTTP challenge. My domain doesn’t delegate NS records to Cloudflare, DigitalOcean, or other DNS authenticator providers listed in the system. I can’t use the shell — I’m too inexperienced to work with it properly. Surely, HTTP authentication isn’t really not supported, is it? Manually uploading a certificate hardly seems like a good idea. Could you please suggest a proper solution for my situation? I’d be grateful for any help!
If the option isn’t exposed in the truenas gui, it’s not supported. So in your case http authentification is not supported.
Is it possible to create a certificate via the shell with HTTP challenge? Are there any other solutions?
A popular option is Community Member Dan’s python script, but i don’t know if it supports http challange.
No, it isn’t–that would require exposing your TrueNAS UI to the Internet, which is strongly discouraged.[1]
My script doesn’t directly support any challenge; it takes a cert that’s been obtained by some other means and installs it to TrueNAS.
Sure: get the cert using some other tool (like, e.g., lego or acme.sh), possibly on the NAS itself or possibly not, and then use another tool (e.g., my script or tnascert-deploy) to install it to TrueNAS. Here’s a guide for this process, though you’d need to adapt it a bit to use HTTP validation:
The basic work flow is:
- Use your preferred ACME client to obtain the cert
- Use the
--renew-hookor equivalent option in that ACME client to call my script,tnascert-deploy, or some other tool to import the cert into TrueNAS
These steps can take place on the NAS or on a different system, at your convenience. If you aren’t doing this on your NAS, you may find tnascert-deploy by @jjrushford to be easier to work with than my script.
Another alternative would be to put the TrueNAS UI behind a reverse proxy, in which case the cert management becomes the reverse proxy’s problem.
Though it would still be nice if the Nginx config resolved
/.well-known/acme-challenge/to a known, or configurable, location–not so much for purposes of obtaining a script from Let’s Encrypt directly as for use with local certificate authorities, though it would work for either. ↩︎
Dear friends, thank you so much for your answers and participation. I will deal with the script operation. Nevertheless, it still seems strange and destructive to me to reduce the functionality of http verification. There is no problem making this check secure. You can temporarily open the port at the time of verification, you can set any other non-80 port, set a write limit. It’s just a file that sticks out from the outside of the system, that’s all.
Thanks again for the help. Yesterday I spent 2 hours searching for information and 6 hours interrogating different ais. I’m afraid they’ll punish me with Arnold Schwarzenegger after Doomsday, but that’s not for sure. 
No, there’s nothing insecure about the check–what’s insecure is exposing your entire web UI, which must respond on port 80 for HTTP validation to work.
It wasn’t removed; it was never there to begin with. It’s only been fairly recently that the ACME function, byzantine as it is, was added to TrueNAS, and DNS validation is all that’s ever been available, though the list of compatible providers has expanded a bit.
As recommended by others, the reverse proxy option is a great way to go. I have NGINX-PM deal with all my certs and then I script the injection of the certs into a number of other machines so that they are never exposed to the internet. Works very well for me and just runs away in the background with some CRON commands.
That said, I use DNS challenge but if I needed HTTP verification, I would much rather expose the NGINX-PM landing page to the internet than the TrueNAS GUI 
I use certbot on a VM to create and renew my certificate with lets encrypt. I use a wild card certificate for all the services on my lan and make use of the certbot renewal hooks to update my services with updated certs. One of the renewal hooks calls tnascert-deploy to update my NAS certificates.