[GH-ISSUE #292] Letsencrypt Support #109

New issue

Closed

opened 2026-02-27 08:15:17 +03:00 by kerem · 4 comments

kerem commented

2026-02-27 08:15:17 +03:00

Owner

Originally created by @zicklag on GitHub (Aug 26, 2022).
Original GitHub issue: https://github.com/lldap/lldap/issues/292

I need the ability to automatically create and renew LDAPS certificates with LetsEncrypt, and I might be willing to develop a pull request. Is this something you would be open to?

Edit: It might be easier for me just to integrate acme.sh into the container instead of building it into service itself. That wouldn't be preferable for users in general, though, so we wouldn't want to implement it like that in this repo probably.

I'm kind of in a hurry to get something working, so I might try that in a separate repo instead of a PR to the core.

Originally created by @zicklag on GitHub (Aug 26, 2022). Original GitHub issue: https://github.com/lldap/lldap/issues/292 I need the ability to automatically create and renew LDAPS certificates with LetsEncrypt, and I might be willing to develop a pull request. Is this something you would be open to? **Edit:** It might be easier for me just to integrate `acme.sh` into the container instead of building it into service itself. That wouldn't be preferable for users in general, though, so we wouldn't want to implement it like that in this repo probably. I'm kind of in a hurry to get something working, so I might try that in a separate repo instead of a PR to the core.

kerem closed this issue

2026-02-27 08:15:17 +03:00

kerem commented

2026-02-27 08:15:18 +03:00

Author

Owner

@nitnelave commented on GitHub (Aug 26, 2022):

Hmm, yes, it seems like you could automate it outside of the container based on cron and acme.sh, and just mount the certificates into the container. I don't think it belongs in LLDAP.

@nitnelave commented on GitHub (Aug 26, 2022): Hmm, yes, it seems like you could automate it outside of the container based on cron and `acme.sh`, and just mount the certificates into the container. I don't think it belongs in LLDAP.

kerem commented

2026-02-27 08:15:18 +03:00

Author

Owner

@KetchupBomb commented on GitHub (Dec 30, 2024):

... and just mount the certificates into the container. ...

@nitnelave, this is the closest topical match I've seen so please pardon the old reply. Assuming the certificate & key are mounted in as Docker volumes from ACME to LLDAP, does LLDAP reload the certificate when ACME rotates them? Or would this require an LLDAP config reload?

If a config reload is required, does LLDAP support some form of signal (SIGHUP?) to do so?

I couldn't find the answer stumbling around the source code as I'm very unfamiliar with Rust. Thanks for any info.

@KetchupBomb commented on GitHub (Dec 30, 2024): > ... and just mount the certificates into the container. ... @nitnelave, this is the closest topical match I've seen so please pardon the old reply. Assuming the certificate & key are mounted in as Docker volumes from ACME to LLDAP, does LLDAP reload the certificate when ACME rotates them? Or would this require an LLDAP config reload? If a config reload is required, does LLDAP support some form of signal (`SIGHUP`?) to do so? I couldn't find the answer stumbling around the source code as I'm very unfamiliar with Rust. Thanks for any info.

kerem commented

2026-02-27 08:15:18 +03:00

Author

Owner

@nitnelave commented on GitHub (Dec 30, 2024):

No, there's no form of certificate reloading implemented, you'd have to restart the server.

@nitnelave commented on GitHub (Dec 30, 2024): No, there's no form of certificate reloading implemented, you'd have to restart the server.

kerem commented

2026-02-27 08:15:18 +03:00

Author

Owner

@KetchupBomb commented on GitHub (Dec 31, 2024):

Thanks @nitnelave.

For those interested, if you, too, want to reload LLDAP when ACME rotates the certificate, one option is Ofelia's job-run execution type. You can spawn an instance of the docker image and docker restart lldap. A blind restart @weekly seems to be sufficient.

@KetchupBomb commented on GitHub (Dec 31, 2024): Thanks @nitnelave. For those interested, if you, too, want to reload LLDAP when ACME rotates the certificate, one option is [Ofelia](https://github.com/mcuadros/ofelia)'s [`job-run`](https://github.com/mcuadros/ofelia/blob/master/docs/jobs.md#job-run) execution type. You can spawn an instance of the `docker` image and [`docker restart lldap`](https://github.com/mcuadros/ofelia/issues/280#issuecomment-2561863012). A blind restart `@weekly` seems to be sufficient.

kerem referenced this issue

2026-02-27 08:17:57 +03:00

[PR #109] [MERGED] Implement a migration tool from LDAP #549