sslbrain ACME Proxy: Certificates without direct internet access

Q: Can I use the proxy for other traffic?

No. The proxy only allows HTTPS CONNECT to acme.sslbrain.com port 443. All other destinations are blocked with HTTP 403. This is by design to minimize the attack surface.

sslbrain includes a built-in forward proxy that lets ACME clients on local servers fetch certificates via the appliance, without the servers needing direct internet access. The proxy only allows connections to acme.sslbrain.com port 443. There is no TLS interception and no general browsing.

How to enable

1 Open sslbrain Settings and go to the Network tab
2 Toggle ACME Proxy on
3 The proxy starts listening on port 3128

The proxy is available at http://<sslbrain-hostname>:3128. Replace <sslbrain-hostname> with the hostname or IP address of your sslbrain appliance on the local network.

Configure lego (Linux)

Set the HTTPS_PROXY environment variable before running lego. This tells lego to route all HTTPS traffic through the sslbrain proxy.

# Set the proxy and run lego
export HTTPS_PROXY=http://sslbrain.local:3128
lego --server https://acme.sslbrain.com/directory \
  --email you@example.com --domains example.com \
  --dns acmedns run

For cron jobs, add the environment variable directly on the cron line:

# /etc/cron.d/lego-renew
0 3 * * * root HTTPS_PROXY=http://sslbrain.local:3128 lego --server https://acme.sslbrain.com/directory renew --days 30

Configure simple-acme (Windows)

Edit settings.json in the simple-acme installation directory and add the proxy configuration:

{
  "Client": {
    "Proxy": {
      "Url": "http://sslbrain.local:3128"
    }
  }
}

If the server was deployed via sslbrain agents, the proxy is configured automatically. No manual editing needed.

Configure certbot (Linux)

Certbot respects the standard HTTPS_PROXY environment variable:

export HTTPS_PROXY=http://sslbrain.local:3128
certbot certonly --server https://acme.sslbrain.com/directory \
  -d example.com --preferred-challenges dns

For automated renewals via certbot renew, add the environment variable to the systemd timer or cron job that runs the renewal.

Automatic agent configuration

When the ACME Proxy is enabled in sslbrain, agents deployed from the appliance automatically receive the proxy configuration. This includes both new agent deployments and configuration updates pushed to existing agents.

No manual setup for managed servers

If your servers are managed by sslbrain agents, you do not need to configure the proxy manually. The agent reads the proxy setting from its configuration and applies it to all ACME requests automatically.

Security

Destination lock. The proxy only allows HTTPS CONNECT to acme.sslbrain.com port 443. All other destinations are blocked with HTTP 403.

No TLS interception. The proxy acts as a TCP tunnel only. It does not terminate, inspect or modify the TLS connection. Your ACME client negotiates TLS directly with acme.sslbrain.com.

Private keys never leave your server. The ACME protocol generates the private key locally. The proxy never sees the key material. Only the Certificate Signing Request (CSR) is sent to the ACME server, encrypted inside the TLS tunnel.

Frequently asked questions about the ACME Proxy

Find answers to the most common questions about SSL certificates and FairSSL.

Does the proxy see my private keys or certificate data?

No. The proxy creates a TCP tunnel (HTTP CONNECT). TLS is end-to-end between your ACME client and acme.sslbrain.com. The proxy cannot read or modify the encrypted traffic. It only sees the destination hostname and port.

Does the proxy need to be running for certificate renewals?

Yes, if your ACME clients are configured to use the proxy. Make sure the proxy is enabled in sslbrain before renewal time. sslbrain-managed agents handle this automatically and will report an error if the proxy is unreachable.

Can I use the proxy for other traffic?

No. The proxy only allows HTTPS CONNECT to acme.sslbrain.com port 443. All other destinations are blocked with HTTP 403. This is by design to minimize the attack surface.

Which ACME clients support proxy configuration?

All major clients: lego, simple-acme (win-acme), certbot, acme.sh, Caddy and Traefik. They all support the standard HTTPS_PROXY environment variable or equivalent proxy settings in their configuration files.