Jump to content
From ArchWiki

acme.sh is an ACME client written purely in shell script. It implements the full ACME protocol and supports, for example, IPv6 and wildcard certificates.

## Installation

Install the acme.sh package, and socat if you want to use the standalone mode.

## Usage

The package does not provide man pages, but a wiki for usage. Executing `acme.sh --help` outputs a long list of commands and parameters.

There are three basic steps involved:

1. Requesting a certificate to be issued.
2. Installing the issued certificate, to make it useful.
3. Maintaining the certificate over time.

as covered with below examples.

### Issuing a new cert

You can specify any domain with the `-d` option.

Tip: You might want to specify LetsEncrypt as your default CA, as acme.sh uses ZeroSSL as its default CA effective from August 1st, 2021.

The `acme.sh` script support different modes. Examples for modes and options to be specified are:

- Webroot mode:

  `$ acme.sh --issue -d example.com -d www.example.com -d cp.example.com -d '*.example.com' -w /home/wwwroot/example.com`

- Standalone mode, by adding `--standalone` if no web server is running (requires socat installed):

  `$ acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com`

- Nginx mode:

  `$ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com`

- DNS mode (see official wiki for further information):

  `$ acme.sh --issue -d example.com -d '*.example.com' --dns dns_he`

The project's wiki lists more examples.

### Install the cert to Apache/Nginx etc

Nginx:

    $ acme.sh --install-cert -d example.com --key-file '/path/to/keyfile/in/nginx/example.key' --fullchain-file '/path/to/fullchain/nginx/example.cer' --reloadcmd "systemctl force-reload nginx"

Apache:

    $ acme.sh --install-cert -d example.com --cert-file '/path/to/certfile/in/apache/example.cer' --key-file '/path/to/keyfile/in/apache/example.key' --fullchain-file '/path/to/fullchain/certfile/apache/example.fullchain.cer' --reloadcmd "systemctl force-reload nginx apache2"

### Maintaining a cert

The certs will be renewed every 60 days. To run `acme.sh` regularly, a systemd timer may be set up.

## See also

- Project homepage and wiki for its documentation.
- acme-tiny offers several related utilities, as well as additional general ACME documentation.
- lacme is a small ACME client written with process isolation and minimal privileges in mind.

Categories:

- Networking
- Encryption
- Commands