ACME

NixOS supports automatic domain validation & certificate retrieval and renewal using the ACME protocol. Any provider can be used, but by default NixOS uses Let's Encrypt. The alternative ACME client lego is used under the hood.

Setup

Following example setup generates certificates using DNS validation.

security.acme = {
  acceptTerms = true;
  defaults.email = "admin+acme@example.com";
  certs."example.com" = {
    domain = "*.example.com";
    dnsProvider = "rfc2136";
    credentialsFile = "/var/lib/secrets/certs.secret";
    # We don't need to wait for propagation since this is a local DNS server
    dnsPropagationCheck = false;
  };
};

See also

• NixOS manual on SSL/TLS Certificates with ACME