OPNsense os-acme-client -> RustProxy

A simple mechanism for automatically sending a certificate generated by os-acme-client on OPNsense to RustProxy via API.

Files

opnsense-rustproxy-cert-deploy.sh - sends the certificate and private key to RustProxy.
rustproxy-acme.conf - connection settings, API token, and certificate file paths.
actions_rustproxy_cert.conf - optional configd action that allows the script to be executed from Cron in OPNsense.

1. Installation

cp opnsense-rustproxy-cert-deploy.sh /usr/local/sbin/
chmod 750 /usr/local/sbin/opnsense-rustproxy-cert-deploy.sh

cp rustproxy-acme.conf.example /usr/local/etc/rustproxy-acme.conf
chmod 600 /usr/local/etc/rustproxy-acme.conf

2. Configuration

Edit:

vi /usr/local/etc/rustproxy-acme.conf

Important parameters:

RUSTPROXY_URL='https://127.0.0.1:9090'
RUSTPROXY_KEY_ID='opnsense-acme'
RUSTPROXY_TOKEN='RUSTPROXY_TOKEN'

CERTIFICATE_ID='shared-cert'

CERT_FILE='/var/etc/acme-client/certs/CERT_UUID/fullchain.pem'
KEY_FILE='/var/etc/acme-client/keys/CERT_UUID/private.key'

If os-acme-client exports the certificate to a custom directory, simply set the correct paths:

CERT_FILE='/path/to/fullchain.pem'
KEY_FILE='/path/to/private.key'

CERTIFICATE_ID is the stable external certificate id. If it does not exist, RustProxy creates a manual certificate entry. If it already exists as a manual certificate, RustProxy rotates it in place. RustProxy-managed ACME ids are rejected to prevent two renewal owners for one lineage.

3. RustProxy API

Create a certificate API key in RustProxy and enter its values in the configuration:

RUSTPROXY_KEY_ID
RUSTPROXY_TOKEN

The script sends the certificate to:

POST /api/certificates/deploy

The connection from OPNsense to RustProxy should use HTTPS.

4. Test

Run the certificate reconciliation:

/usr/local/sbin/opnsense-rustproxy-cert-deploy.sh

On success, you should see a message similar to:

RustProxy certificate reconcile succeeded (HTTP 200, id=shared-cert)

5. OPNsense Automation

Optionally install the configd action:

cp actions_rustproxy_cert.conf /usr/local/opnsense/service/conf/actions.d/
service configd restart

Then go to System -> Settings -> Cron and add a scheduled execution of the Deploy ACME certificate to RustProxy action.

The script deliberately reconciles on every run instead of trusting a local cache. The server is the source of truth: an identical RustProxy-owned certificate generation is a no-op, a missing id is created, and changed material is rotated atomically. This also repairs drift when a certificate entry or generation was removed outside OPNsense.

Additional Options

If RustProxy uses a private CA:

RUSTPROXY_CACERT='/usr/local/etc/ssl/rustproxy-ca.pem'

If you want to connect to a specific LAN address while keeping proper TLS hostname verification:

RUSTPROXY_RESOLVE='rustproxy.lan:8443:192.168.1.20'