How to disable verification of the ACME server's certificate or trust a custom CA certificate file

[abdeldjalil-fellah]

How to disable verification of the ACME server's certificate (--no-verify-ssl in certbot) or trust a custom CA certificate file (without adding it to system trust store, REQUESTS_CA_BUNDLE environment variable in certbot) to avoid this error: tls: failed to verify certificate: x509: certificate signed by unknown authority?

[ldez]

There is no CLI option to do that.

It's a bit weird to skip the TLS verification for the ACME server.

[ldez]

Note: you can use LEGO_CA_CERTIFICATES to add your certificates.
Additionally, you can use LEGO_CA_SYSTEM_CERT_POOL to skip the system cert pool.
And you also have LEGO_CA_SERVER_NAME.

LEGO_CA_CERTIFICATES is the environment variable that can be used to specify the path to PEM encoded CA Certificates
that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list.
Multiple file paths can be added by using : (unix) or ; (Windows) as a separator.

# On Unix system
LEGO_CA_CERTIFICATES=/foo/cert1.pem:/foo/cert2.pem

LEGO_CA_SYSTEM_CERT_POOL is the environment variable that can be used to define if the certificates pool must use a copy of the system cert pool.

LEGO_CA_SYSTEM_CERT_POOL=true

LEGO_CA_SERVER_NAME is the environment variable that can be used to specify the CA server name
that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list.

LEGO_CA_SERVER_NAME=foo

[ldez]

I created a PR to add the option: #2335

[abdeldjalil-fellah]

please add the above environment variables to the documentation