SRX ACME Certs

ACME Certificate support works in 22.4R1-S1+

The SRX supports the http-01 ACME challenge.  When doing an ACME enroll, the SRX will spin up a port 80 listener and host the requested file itself, then terminate the daemon.  As such, you need to have http enabled from outside world in your Protect-RE and enabled on your exterior zone.  Your SRX will also need to be DNS reachable to the domain name you are enrolling.  Thus, this is difficult on an internal FW for testing.

Once the FW is DNS reachable (dynamic dns works fine) and ready to not drop port 80, you can configure ACME:

request security pki generate-key-pair size 2048 type rsa acme-key-id ACME-KEY
request security pki generate-key-pair size 2048 type rsa certificate-id ACME-RA-CERT

set security pki ca-profile ISRG_Root_X1 ca-identity ISRG_Root_X1
set security pki ca-profile ISRG_Root_X1 pre-load
set security pki ca-profile ISRG_Root_X1 revocation-check disable
set security pki ca-profile Lets_Encrypt ca-identity Lets_Encrypt
set security pki ca-profile Lets_Encrypt enrollment url https://acme-v02.api.letsencrypt.org/directory
set security pki traceoptions file pki.log
set security pki traceoptions file size 10m
set security pki traceoptions file files 3
set security pki traceoptions flag all
set security pki traceoptions flag acme-enrollment

request security pki local-certificate enroll acme acme-key-id ACME-KEY certificate-id ACME-RA-CERT ca-profile Lets_Encrypt domain-names vpn.domain.com email "[email protected]" letsencrypt-enrollment yes terms-of-service agree

You can then set auto-re-enrollment

set security pki auto-re-enrollment acme certificate-id ACME-RA-CERT re-enroll-time days 25
set security pki auto-re-enrollment acme certificate-id ACME-RA-CERT acme-key-id ACME-KEY
set security pki auto-re-enrollment acme certificate-id ACME-RA-CERT ca-profile-name Lets_Encrypt
set security pki auto-re-enrollment acme certificate-id ACME-RA-CERT re-enroll-trigger-time-percentage 72
set security pki auto-re-enrollment acme certificate-id ACME-RA-CERT re-generate-keypair
set security pki acme-account-key acme-key-id ACME-KEY

Please note depending on Lets Encrypt you may have to add a new cert chain to the SRX as intermediate certs may change on how they sign.