acmesh-official/acme.sh

Maintainer? Show your league in your README

Card: your league's emblem, from Copper to Legendary

[![bestofgithub](https://bestofgithub.dev/badge/acmesh-official/acme.sh.svg?style=card)](https://bestofgithub.dev/repo/acmesh-official/acme.sh)

Flat: fits beside your other badges

[![bestofgithub](https://bestofgithub.dev/badge/acmesh-official/acme.sh.svg)](https://bestofgithub.dev/repo/acmesh-official/acme.sh)

Loading README…

NO	Status	Platform
1		Mac OSX
2		Windows (cygwin with curl, openssl and crontab included)
3		FreeBSD
4		Solaris
5		Ubuntu
6	NA	pfsense
7		OpenBSD
8		NetBSD
9		DragonFlyBSD
10		MidnightBSD
11		Omnios
12		OpenIndiana
13		Debian
14		openSUSE
15		Alpine Linux (with curl)
16		Archlinux
17		fedora
18		Kali Linux
19		Oracle Linux
20		Mageia
21		Gentoo Linux
22	-----	Cloud Linux #111
23	-----	OpenWRT: Tested and working. See wiki page
24		Proxmox: See Proxmox VE Wiki. Version 4.x, 5.0, 5.1, version 5.2 and up
25		Haiku OS
26		Tribblix
27		GhostBSD
28		GNU Hurd
29		openEuler
30		HardenedBSD
31		OPNsense

CA	Status
ZeroSSL.com CA	⭐ Default
Letsencrypt.org CA	✅ Supported
SSL.com CA	✅ Supported
Google.com Public CA	✅ Supported
Actalis.com CA	✅ Supported
Pebble strict Mode	✅ Supported
Any RFC8555-compliant CA	✅ Supported

Mode	Description
📁 Webroot mode	Use existing webroot directory
🖥️ Standalone mode	Built-in webserver on port 80
🔐 Standalone tls-alpn mode	Built-in webserver on port 443
🪶 Apache mode	Use Apache for verification
⚡ Nginx mode	Use Nginx for verification
🌐 DNS mode	Use DNS TXT records
🔗 DNS alias mode	Use DNS alias for verification
📡 Stateless mode	Stateless verification
📌 DNS persist mode	Persistent DNS TXT record (draft-ietf-acme-dns-persist-01)

Flag	Description
`--server <ca>`	Pick the CA (default is your configured default). The account is registered automatically if you have not used this CA before.
`--dns-persist-wildcard`	Adds `policy=wildcard` to the record so it also authorizes wildcard / subdomain certs.
`--dns-persist-ca-name <name>`	Use a specific CA identity domain (e.g. `sectigo.com`). If omitted, identities are read from the ACME directory's `caaIdentities` field and one record per identity is printed — you only need to add any one of them.
`--dns-persist-days <N>`	Adds `persistUntil=<unix-timestamp>` to the record, set to N days from now. The CA will refuse new validations against the record after that time. Omit for a record with no expiry.

Key Length	Description
`ec-256`	prime256v1, "ECDSA P-256" ⭐ Default
`ec-384`	secp384r1, "ECDSA P-384"
`ec-521`	secp521r1, "ECDSA P-521" ⚠️ Not supported by Let's Encrypt yet
`2048`	RSA 2048-bit
`3072`	RSA 3072-bit
`4096`	RSA 4096-bit

What	When	Why
🔍 Polls `suggestedWindow`	Every cron run, before deciding to skip	Lets the CA shift the renewal time forward in case of an incident (key compromise, mass revocation, etc.)
🎯 Picks a random renewal time inside the window	Right after a successful issuance/renewal	Disperses renewals across the network so all clients don't hit the CA at the same instant
🔗 Sends `replaces=<certID>` in `newOrder`	On renewal	Lets the CA correlate the new order with the certificate it supersedes (RFC 9773 §5)
↩️ Retries without `replaces`	If the CA rejects with `alreadyReplaced` or an ARI validation error	Robust against edge cases (e.g. switching CAs, retired issuers)

Project	Link
🙏 Acme-tiny	https://github.com/diafygi/acme-tiny
📜 ACME protocol	https://github.com/ietf-wg-acme/acme

🔐 acme.sh

An ACME Protocol Client Written Purely in Shell

✨ Features

🌏 中文说明

🏆 Who Uses acme.sh?

🖥️ Tested OS

🏛️ Supported CA

⚙️ Supported Modes

📖 Usage Guide

1️⃣ How to Install

📥 Install Online

📦 Install from Git

🔏 Verify a Release

2️⃣ Issue a Certificate

3️⃣ Install the Certificate to Apache/Nginx

🪶 Apache Example:

⚡ Nginx Example:

4️⃣ Use Standalone Server to Issue Certificate

5️⃣ Use Standalone TLS Server to Issue Certificate

6️⃣ Use Apache Mode

7️⃣ Use Nginx Mode

8️⃣ Automatic DNS API Integration

9️⃣ Use DNS Manual Mode

🔟 Use DNS Persist Mode

🪄 Step 1: Print the TXT record value

✍️ Step 2: Add the TXT record to your DNS

📜 Step 3: Issue the certificate

1️⃣1️⃣ Issue Certificates of Different Key Types (ECC or RSA)

Single domain with ECDSA P-384 certificate

SAN multi domain with RSA4096 certificate

1️⃣2️⃣ Issue Wildcard Certificates

1️⃣3️⃣ How to Renew Certificates

📡 ACME Renewal Information (ARI) — RFC 9773

1️⃣4️⃣ How to Stop Certificate Renewal

1️⃣5️⃣ How to Upgrade acme.sh

1️⃣6️⃣ Issue a Certificate from an Existing CSR

1️⃣7️⃣ Send Notifications in Cronjob

1️⃣8️⃣ Under the Hood

1️⃣9️⃣ Acknowledgments

👥 Contributors

💻 Code Contributors

💰 Financial Contributors

👤 Individuals

🏢 Organizations

2️⃣0️⃣ License & Others

2️⃣1️⃣ Donate

2️⃣2️⃣ About This Repository