README

🔐 acme.sh
An ACME Protocol Client Written Purely in Shell


  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  



  
  
  



  
  
  
  



---

 ✨ Features

- 🐚 An ACME protocol client written purely in Shell (Unix shell) language
- 📜 Full ACME protocol implementation
- 🔑 Support ECDSA certificates
- 🌐 Support SAN and wildcard certificates
- ⚡ Simple, powerful and very easy to use — only 3 minutes to learn!
- 🔧 Compatible with Bash, dash and sh
- 🚫 No dependencies on Python
- 🔄 One script to issue, renew and install your certificates automatically
- 👤 DOES NOT require root/sudoer access
- 🐳 Docker ready
- 🌍 IPv6 ready
- 📧 Cron job notifications for renewal or error

 💡 It's probably the easiest & smartest shell script to automatically issue & renew free certificates.


  📚 Wiki •
  🐳 Docker Guide •
  🐦 Twitter


---

 🌏 中文说明

---

 🏆 Who Uses acme.sh?
- FreeBSD.org
- ruby-china.org
- Proxmox
- pfsense
- Loadbalancer.org
- discourse.org
- Centminmod
- splynx
- opnsense.org
- CentOS Web Panel
- lnmp.org
- more...

---

 🖥️ Tested OS

| NO | Status| Platform|
|----|-------|---------|
|1||Mac OSX
|2||Windows (cygwin with curl, openssl and crontab included)
|3||FreeBSD
|4||Solaris
|5|| Ubuntu
|6|NA|pfsense
|7||OpenBSD
|8||NetBSD
|9||DragonFlyBSD
|10||MidnightBSD
|11||Omnios
|12||OpenIndiana
|13|| Debian
|14||openSUSE
|15||Alpine Linux (with curl)
|16||Archlinux
|17||fedora
|18||Kali Linux
|19||Oracle Linux
|20||Mageia
|21||Gentoo Linux
|22|-----| Cloud Linux  https://github.com/acmesh-official/acme.sh/issues/111
|23|-----| OpenWRT: Tested and working. See wiki page
|24|| Proxmox: See Proxmox VE Wiki. Version 4.x, 5.0, 5.1Let.27s_Encrypt_using_acme.sh), version 5.2 and up
|25||Haiku OS
|26||Tribblix
|27||GhostBSD
|28||GNU Hurd
|29||openEuler
|30||HardenedBSD
|31||OPNsense


 🧪 Check our testing project

 🖥️ The testing VMs are supported by vmactions.org

---

 🏛️ Supported CA

| CA | Status |
|---|---|
| ZeroSSL.com CA | ⭐ Default |
| Letsencrypt.org CA | ✅ Supported |
| SSL.com CA | ✅ Supported |
| Google.com Public CA | ✅ Supported |
| Actalis.com CA | ✅ Supported |
| Pebble strict Mode | ✅ Supported |
| Any RFC8555-compliant CA | ✅ Supported |

---

 ⚙️ Supported Modes

| Mode | Description |
|------|-------------|
| 📁 Webroot mode | Use existing webroot directory |
| 🖥️ Standalone mode | Built-in webserver on port 80 |
| 🔐 Standalone tls-alpn mode | Built-in webserver on port 443 |
| 🪶 Apache mode | Use Apache for verification |
| ⚡ Nginx mode | Use Nginx for verification |
| 🌐 DNS mode | Use DNS TXT records |
| 🔗 DNS alias mode | Use DNS alias for verification |
| 📡 Stateless mode | Stateless verification |
| 📌 DNS persist mode | Persistent DNS TXT record (draft-ietf-acme-dns-persist-01) |

---

 📖 Usage Guide

 1️⃣ How to Install

 📥 Install Online

 Check this project: https://github.com/acmesh-official/get.acme.sh

bash
curl https://get.acme.sh | sh -s [email protected]


Or:

bash
wget -O -  https://get.acme.sh | sh -s email=my@example

Top issues

Discussions

Latest release

1. Release tags are signed from 3.1.6 on. The public key is allowed_signers
in this repository; see "Verify a Release" in the README.
2. 3.1.5 and earlier are unsigned. The 3.1.5 tag was created by the GitHub
release form, which can only produce a lightweight tag and therefore carries
no signature (7273).
3. No functional change since 3.1.5.