Secure your Unraid WebGUI with a free and trusted SSL certificate using acme.sh and ZeroSSL¹.

 

This plugin automates certificate issuance and renewal using the DNS-01 challenge¹, allowing you to enable HTTPS access to your server without relying on open ports or public web access.

 

Plugin URL: https://raw.githubusercontent.com/morgendagen/Unraid-Secure-WebGUI/refs/heads/main/ACME.plg

 

Features:

 

• Use your own domain or subdomain for secure access
• Easily obtain certificates from ZeroSSL¹
• Uses the DNS-01 challenge method (API credentials required)¹
• Keeps your WebGUI secure with scheduled certificate renewals
• Notifications to stay informed about renewals or issues
• Built on the flexible, scriptable acme.sh ACME client
• Free tier ZeroSSL account creation

 

Requirements:

 

• DNS provider supported by acme.sh (e.g., Cloudflare, Route53, etc.)¹
• An account with ZeroSSL (free tier supported)¹

 

Disclaimer:

 

• This plugin modifies SSL settings in Unraid, specifically overwriting the self-signed certificate located in /boot/config/ssl/certs/.

 

¹ Pull requests welcome! Contributions to add support for other ACME providers and challenge types are encouraged.

I just tested this plugin and it worked perfectly with my personal domains on Cloudflare, many thanks for this excellent automation it is very much appreciated 😁
Some notes for anyone else interested in testing this:

• You can test everything works manually first ( which is how I had SSL set up previously ) if you prefer to have an emergency fallback option
  - I'm happy to share details of the manual approach that I took beforehand so if anyone is interested, just ask

• The install method I used was to copy and paste the raw plugin URL from Github (above) directly into the install plugin option in unRAID

• I already had my personal domain email registered beforehand with ZeroSSL so unsure how well it works registering a fresh one

• The last few lines output after plugin installation were as follows
  Running reload cmd: /usr/share/ACME/scripts/reloadcmd /boot/config/ssl/certs/unraid_unraid_bundle.pem

  Installing certificate...

  Reloading nginx...

  Stopping nchan processes...
  ^ you can click the [Done] button at this point, there was also a successful popup notification saying 'Certificate renewed' - nice!

Overall this automation should save me about fifteen minutes every few months - very nice so thanks again @morgendagen excellent work 👍

Edited February 1Feb 1 by manfat

The 'fix common problems' plugin just generated the following warning message: "The plugin ACME.plg is not known to Community Applications and is possibly incompatible with your server"
with a suggested fix comment: "As a general rule, if the plugin is not known to Community Applications, then it is not compatible with your server. It is recommended to uninstall this plugin"

so I'm just wondering how to get this useful plugin added so that it can be recognised by CA as compatible? Otherwise I'm quite happy to just ignore the warning for now.

Great job, thanks for the plugin! I just used it with 7.3.0-beta.1 install.

I hope You could update the plugin so that when using Cloudflare DNS-01 one could use Account API Tokens instead of Account API Keys. API Tokens can be limited to have access only editing specific domain dns entries vs Account API Key which in my understanding is the "keys to the kingdom".

Just got the 'fix common problems' plugin warnings again about this plugin not being known to Community Applications and is possibly incompatible.
Any ideas on how to get this useful plugin added to Community Applications so these warnings stop?

On 3/29/2026 at 7:27 PM, RapidReason said:

Great job, thanks for the plugin! I just used it with 7.3.0-beta.1 install.

I hope You could update the plugin so that when using Cloudflare DNS-01 one could use Account API Tokens instead of Account API Keys. API Tokens can be limited to have access only editing specific domain dns entries vs Account API Key which in my understanding is the "keys to the kingdom".

Found a hotfix, Api Tokens are marked as alternatives at acme.sh. You can change the file /usr/local/emhttp/plugins/ACME/dnsapi_info.txt, search for dns_cf and remove the Block "Options:" then rename "OptionsAlt:" to "Options:" and reload config page 😊

/usr is in RAM with the rest of OS files so changes there won't persist

I have just released a new version of the plugin that updates acme.sh to version 3.1.3 and adds support for alternative options (OptionsAlt).

Please let me know if there are any issues - I have not been able to do extensive testing myself.

Regarding Community Applications: I have submitted a request for inclusion of this plugin. the last time I tried getting the plugin added, it fell on deaf ears. I'll see if I can find someone to contact.

Edited June 23Jun 23 by morgendagen