Replacing the Self Signed Certificate in OPNsense with Let's Encrypt

You may have noticed when you log into OPNsense and see a warning message that a self-signed certificate is used for the web interface by default. You may replace the self-signed certificate with a free Let's Encrypt certificate using the ACME plugin.

A self-signed certificate is less secure than a real certificate since there is nothing authoritative about a self-signed certificate. Malicious users may easily generate self-signed certificates you will not know which self-signed certificate is the legitimate one.

In order to use a self-signed certificate, you must use a real domain name you own or a dynamic DNS domain name. I use Cloudflare as an example.

For a written version of this guide, please visit my website:

00:00 Introduction
01:13 Setting up an API Key (Cloudflare)
04:08 Installing the ACME client
05:22 ACME Settings page overview
05:34 ACME Accounts page
06:10 ACME Challenge Types page
07:48 ACME Automations page
08:24 ACME Certificates page
11:00 ACME Settings page
11:35 Changing the default certificate
12:16 Logging into OPNsense web UI
13:12 Outtake

EP20

[AmirHomayounSadoughi]

Came back here to check the walk through after almost a year. Still very helpful! Just wanted to say thanks!

[AnttiPW]

Thanks for the tutorial. I got validation failed the first time, but after copy pasting the key again, it for some reason worked.

[JasonsLabVideos]

Your hard work is appreciated by a lot of people !! We will do our colab soon, I swear it !!

[juha_uotila]

Thanks for another great tutorial. Your videos are the one main reason i switched to opnsense from pfsense.

[rockbaoboa]

Thank you very much for the video.... You won another write-up

[kanes]

Thanks for putting this out, I messed up with the Hostname on my first attempt, went back and sorted it out and all it great! thanks again!

[TismoGaming]

Thank you for your videos. I hope you convert all your articles concerning opnsense into videos !!!

[alexisbeaulieu]

As always, that's a lot of valuable information. Thanks!

[atomikrobot]

Thank you for finally encouraging me to do this! I've been lazy with some other self-signed certs in my homelab too!

[heykenthay]

Thank you for your videos and all your hard work. Its really helped me with my opnsense install.

[zigotica]

super awesome and easy to follow video, thank you so much!

[djbusters]

This is super easy and fun way to explain cert in opnsense. Thank you. even though not using the same provider for dns but it works like a charm.
Just one request, i hope you can slow down a bit while explain the topic. Does not have to but makes a bit easy follow. :)

[seungmincho]

thanks so much!! finally i can auto renow my ssl certificate

[clestonmaia]

pretty well ... congrats for tutorial. All ok for here. Thanks mate

[jeffreyooi]

I want to set the auto renewal of the certificate during day time like 8:00 AM to 6:00 PM on the month of the expire certificate (example November expired) 60 days before the expire, how do I set it in the CRON job?

[MrAasi]

Hi, great tutorial, but my process stops at the part about Cloudflare ID and zone. Because I don't have any webpages, I can't find these in my profile.

[andydk]

Could there be additional configuration when using adguard and using unbound as upstream? I’m able to get a cert and everything else up but otherwise times out when using the domain name.

I’m still able to access the router via ip or the name I gave it as a dns rewrite in adguard

[shuflel]

Great video! Thanks for explaining it in such detail :D

[jeytis]

Great and useful video. It works like a charm. One question. I have a website running on a pc behind OPNsense, in its LAN, and I'd like to enable https for it. Do I need to create another token? Thanks

[JustinJohnson]

Thanks for the video. Excellent tutorial! Pardon my ignorance but how would I also add certs to local/internal things like Proxmox?