Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Is your feature request related to a problem? Please describe.
The ACME Client plugin (security/acme-client) already has automations to
deploy a renewed certificate to a remote host via SFTP or a generic SSH
command ("Upload certificate via SFTP", "Remote Command via SSH"), but
neither fits JetKVM KVM-over-IP devices well:
JetKVM's minimal userspace doesn't ship scp/an SFTP server, and there's
no existing automation tailored to where/how JetKVM expects a "Custom" TLS
certificate to be deployed.
Today, applying a fresh ACME certificate to a JetKVM device requires a
human to manually copy the cert/key over and restart the device every
renewal cycle.
Describe the solution you'd like
A new "Run Command" automation, "Upload certificate to JetKVM (SSH)", that:
- Reuses the plugin's existing SSH key management
(OPNsense\AcmeClient\SSHKeys) and identity/known_hosts store, shared
with the existing SFTP/SSH automations.
- Opens a plain SSH exec session and writes the cert/key via a small POSIX
shell script piped over stdin (no scp/SFTP server dependency on the
device side).
- Defaults to JetKVM's confirmed "Custom" TLS storage path/filenames
(/userdata/jetkvm/tls/user-defined.crt and .key), with an optional
post-upload command (defaulting to reboot, since JetKVM has no
hot-reload for a new "Custom" certificate) so the whole thing can run
unattended as part of normal ACME renewal.
Describe alternatives you've considered
Reusing the existing SFTP automation was considered first, but JetKVM's
minimal userspace isn't guaranteed to include an SFTP server, so a plain
SSH-exec approach was used instead.
Additional context
I've already implemented this and opened a pull request:
#5621
That PR includes real-hardware validation notes (confirmed storage
path/filenames, confirmed reboot-to-apply behavior, confirmed the device's
"HTTPS Mode" must already be set to "Custom" before uploads take effect)
and an AI-tools disclosure per the contributing guidelines.
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
Is your feature request related to a problem? Please describe.
The ACME Client plugin (
security/acme-client) already has automations todeploy a renewed certificate to a remote host via SFTP or a generic SSH
command ("Upload certificate via SFTP", "Remote Command via SSH"), but
neither fits JetKVM KVM-over-IP devices well:
JetKVM's minimal userspace doesn't ship
scp/an SFTP server, and there'sno existing automation tailored to where/how JetKVM expects a "Custom" TLS
certificate to be deployed.
Today, applying a fresh ACME certificate to a JetKVM device requires a
human to manually copy the cert/key over and restart the device every
renewal cycle.
Describe the solution you'd like
A new "Run Command" automation, "Upload certificate to JetKVM (SSH)", that:
(
OPNsense\AcmeClient\SSHKeys) and identity/known_hostsstore, sharedwith the existing SFTP/SSH automations.
shell script piped over stdin (no
scp/SFTP server dependency on thedevice side).
(
/userdata/jetkvm/tls/user-defined.crtand.key), with an optionalpost-upload command (defaulting to
reboot, since JetKVM has nohot-reload for a new "Custom" certificate) so the whole thing can run
unattended as part of normal ACME renewal.
Describe alternatives you've considered
Reusing the existing SFTP automation was considered first, but JetKVM's
minimal userspace isn't guaranteed to include an SFTP server, so a plain
SSH-exec approach was used instead.
Additional context
I've already implemented this and opened a pull request:
#5621
That PR includes real-hardware validation notes (confirmed storage
path/filenames, confirmed reboot-to-apply behavior, confirmed the device's
"HTTPS Mode" must already be set to "Custom" before uploads take effect)
and an AI-tools disclosure per the contributing guidelines.