### Author:  [@JuggerbAUT](https://discourse.nixos.org/u/JuggerbAUT)
#### Post date: [December 14, 2025, 12:09am UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/1 "2025-12-14T00:09:50Z")
Hello,
I recently upgraded from NixOS 24.11 to 25.11 (system.stateVersion = “25.11”) and am now unable to get a Let’s Encrypt certificate via the Cloudflare DNS provider. The security.acme service persistently defaults to using minica to
generate a self-signed certificate, ignoring the dnsProvider configuration.
This leads to “Invalid SSL certificate” errors when Cloudflare’s SSL/TLS mode is set to “Full (Strict)”.
Relevant `configuration.nix`:
```auto
1 { config, pkgs, ... }: {
2 system.stateVersion = "25.11";
3
4 # Nginx
5 services.nginx.virtualHosts."example.cc" = {
6 forceSSL = true;
7 useACMEHost = "example.cc";
8 # ...
9 };
```
```auto
10
11 # ACME
12 security.acme = {
13 acceptTerms = true;
14 defaults.email = “example@gmail.com”;
15
16 certs.“example.cc” = {
17 domain = “example.cc”;
18 dnsProvider = “cloudflare”;
19 credentialsFile = “/etc/nixos/secrets/cloudflare-acme”;
20 group = “nginx”;
21 };
22 };
23 }
```
`journalctl -u acme-example.cc.service` logs:
The logs consistently show minica being executed, never lego:
```auto
1 Starting Ensure certificate for example.cc…
2 + minica --ca-key ca/key.pem --ca-cert ca/cert.pem --domains example.cc
3 …4 Finished Ensure certificate for example.cc.
```
What has been tried:
- Confirmed credentialsFile path is correct.
- Confirmed the secret file at /etc/nixos/secrets/cloudflare-acme has the correct format (CLOUDFLARE\_DNS\_API\_TOKEN=“…”).
- Confirmed the secret file has secure permissions (640, owned by root:users).
- The Cloudflare API Token has Zone:DNS:Edit permissions for the correct zone.
- This exact setup was working on NixOS 24.11.
It seems the security.acme module on 25.11 is not respecting the dnsProvider attribute. Is this a known bug, or is there a new, required option to force the lego backend?
Thank you
---
### Author:  [@adamcstephens](https://discourse.nixos.org/u/adamcstephens)
#### Post date: [December 14, 2025, 12:39am UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/2 "2025-12-14T00:39:35Z")
The minica certificate is a placeholder certificate which is replaced by security.acme with the valid certificate. It’s likely your certificate request is failing. Check your logs, and especially `acme-order-renew-.service`
---
### Author:  [@dtannock](https://discourse.nixos.org/u/dtannock)
#### Post date: [December 14, 2025, 2:04am UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/3 "2025-12-14T02:04:59Z")
system.stateVersion = “25.11”
Separately, just checking you didn’t change that when you upgraded? You should never change stateVersion (you’ll find a lot of posts here that go into this).
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [December 14, 2025, 3:08am UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/4 "2025-12-14T03:08:49Z")
To be more specific: `stateVersion` has **nothing to do with your NixOS version** , so never touch it. You only touch your flake inputs or channels or whatever you use to fetch nixpkgs.
Not related to your issue though. The `certToConfig` function
[nixpkgs/nixos/modules/security/acme/default.nix at 09eb77e94fa25202af8f3e81ddc7353d9970ac1b · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/blob/09eb77e94fa25202af8f3e81ddc7353d9970ac1b/nixos/modules/security/acme/default.nix) generates self-signed certs using `minica` then performs ordering/renewal via `lego`. There was a huge refactor in [https://github.com/NixOS/nixpkgs/pull/422076](https://github.com/NixOS/nixpkgs/pull/422076) that removed the `preliminarySelfsigned` option which is probably what changed from before.
But you’re also looking at the wrong service - `acme-${cert}.service` is the prelim self-signed cert service, while `acme-order-renew-${cert}.service` is what calls `lego`.
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [December 14, 2025, 3:40am UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/5 "2025-12-14T03:40:27Z")
> [@dtannock](#):
>
> system.stateVersion = “25.11”
We really should have gone with hashing that string. Well, at least people aren’t setting it to `unstable` anymore.
---
### Author:  [@JuggerbAUT](https://discourse.nixos.org/u/JuggerbAUT)
#### Post date: [December 14, 2025, 4:28pm UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/6 "2025-12-14T16:28:40Z")
i set it up on a completely new pc - and i didn’t check which version was stated in the original file…
set it back to 24.11. Thx 4 clarifying.
---
### Author:  [@JuggerbAUT](https://discourse.nixos.org/u/JuggerbAUT)
#### Post date: [December 14, 2025, 4:29pm UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/7 "2025-12-14T16:29:30Z")
This helped a lot.
Thx
---
### Author:  [@waffle8946](https://discourse.nixos.org/u/waffle8946)
#### Post date: [December 14, 2025, 4:58pm UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/8 "2025-12-14T16:58:18Z")
On a new PC you can set it to whatever. Actually you probably should’ve just left it at 25.11 since you already set it. If you say you “upgraded” NixOS, we’re going to assume you’re referring to the same machine not a new one.
---
### Author:  [@JuggerbAUT](https://discourse.nixos.org/u/JuggerbAUT)
#### Post date: [December 14, 2025, 5:03pm UTC](https://discourse.nixos.org/t/security-acme-defaults-to-minica-instead-of-lego-with-cloudflare-dns-on-nixos-25-11/73220/9 "2025-12-14T17:03:55Z")
Yeah my bad for misleading wording by not specifying that i switched to a new pc.