Hi Matthias, Currently, the mgmt-gateway (and the rest of cephadm services) don't support ACME integration. Users must manually provide/update the external certificates. So as I see it it's not a "lack of documentation", in this case ACME is not a supported option. That said, I think this can be achieved using the current implementation without any extra code changes in cephadm. The key insight is that cephadm's certmgr already has all the necessary components: it monitors cert expiry, and when it detects a certificate has changed in the store, it automatically triggers a reconfig of the mgmt-gateway. So the only missing piece for externally-managed certs is the renewal trigger itself. For that, "ceph orch certmgr cert ls --filter-by status=expiring" can be used to detect expiring certificates and kick off the renewal process. The procedure can be: 1. Set certificate_source: reference in the mgmt-gateway spec. This tells certmgr the cert is externally owned and makes it accept pushes via "ceph orch certmgr cert set." 2. Run certbot (or your tool of choice) with DNS-01 (or HTTP) challenge which avoids any port-80 conflict with mgmt-gateway already owning the HTTPS endpoint. 3. A simple daily systemd timer runs a script that: - Queries ceph orch certmgr cert ls --filter-by "status=expiring" to check if renewal is needed - If yes, calls cerbot renew procedure - Pushes the new cert+key into certmgr via ceph "orch certmgr cert set / key set" - cephadm's serve loop detects the cert change on its next cycle and reconfigures mgmt-gateway automatically (no manual restart needed). 4. For security, the script should use a dedicated client keyring with caps restricted to only the two certmgr write commands. Best, Redouane. On Mon, Mar 30, 2026 at 2:27 PM Matthias Riße via ceph-users < ceph-users@ceph.io> wrote:
Hey all!
I've just managed to get the mgmt-gateway working on our Ceph Cluster with cephadm, which is quite cool to have as a single HA entrypoint. I am surprised about the lack of documentation to get ACME-signed certificates into / in front of the mgmt-gateway.
Is anyone doing this already? If yes, what's your setup? I am wondering if it is easier to put certbot, lego, or similar into a "custom container service" and update the mgmt-gateway service with renewed certs from there, or run an additional caddy instance (also as a custom container service?) as a reverse proxy in front of the mgmt-gateway and let it handle ACME.
Kind regards Matthias
--
---------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------- Forschungszentrum Jülich GmbH 52425 Jülich Sitz der Gesellschaft: Jülich Eingetragen im Handelsregister des Amtsgerichts Düren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Stefan Müller Geschäftsführung: Prof. Dr. Astrid Lambrecht (Vorsitzende), Dr. Stephanie Bauer (stellvertretende Vorsitzende), Prof. Dr. Ir. Pieter Jansens, Prof. Dr. Laurens Kuipers
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
_______________________________________________ ceph-users mailing list -- ceph-users@ceph.io To unsubscribe send an email to ceph-users-leave@ceph.io