acme.sh

acme.sh is an ACME client written purely in shell script. It implements the full ACME protocol and supports, for example, IPv6 and wildcard certificates.

Installation

Install the acme.sh package, and socat if you want to use the standalone mode.

Usage

The package does not provide man pages, but a wiki for usage. Executing acme.sh --help outputs a long list of commands and parameters.

There are three basic steps involved:

  1. Requesting a certificate to be issued.
  2. Installing the issued certificate, to make it useful.
  3. Maintaining the certificate over time.

as covered with below examples.

Issuing a new cert

You can specify any domain with the -d option.

Tip: You might want to specify LetsEncrypt as your default CA, as acme.sh uses ZeroSSL as its default CA effective from August 1st, 2021.

The acme.sh script support different modes. Examples for modes and options to be specified are:

  • Webroot mode:
$ acme.sh --issue -d example.com -d www.example.com -d cp.example.com -d '*.example.com' -w /home/wwwroot/example.com
  • Standalone mode, by adding --standalone if no web server is running (requires socat installed):
$ acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
  • Nginx mode:
$ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com

The project's wiki lists more examples.

Install the cert to Apache/Nginx etc

Nginx:

$ acme.sh --install-cert -d example.com --key-file '/path/to/keyfile/in/nginx/example.key' --fullchain-file '/path/to/fullchain/nginx/example.cer' --reloadcmd "systemctl force-reload nginx"

Apache:

$ acme.sh --install-cert -d example.com --cert-file '/path/to/certfile/in/apache/example.cer' --key-file '/path/to/keyfile/in/apache/example.key' --fullchain-file '/path/to/fullchain/certfile/apache/example.fullchain.cer' --reloadcmd "systemctl force-reload nginx apache2"

Maintaining a cert

The certs will be renewed every 60 days. To run acme.sh regularly, a systemd timer may be set up.

gollark: Something something correlation causation.
gollark: Moderation activities, nominally speaking.
gollark: Simply ping staff constantly when all decision is to occur.
gollark: People's claims to have no choice are mostly not actually true.
gollark: This is an entirely possible and consistent action.

See also
  • Project homepage and wiki for its documentation.
  • acme-tiny offers several related utilities, as well as additional general ACME documentation.
  • lacme is a small ACME client written with process isolation and minimal privileges in mind.
This article is issued from Archlinux. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.