Skip to main content
Certificate issuance

Free HTTPS Certificates with acme.sh — Shell-based Automation

Install and configure acme.sh for Let's Encrypt issuance, DNS validation, automatic renewal, and deployment.

CertOne2 min read

Use the open-source acme.sh client to request free certificates from Let's Encrypt and automate their renewal and deployment.

1. What is Let's Encrypt?​

Let's Encrypt is a free, automated, and open certificate authority (CA) working to make HTTPS widely accessible and the internet more secure.

  • Free: Let's Encrypt removes certificate fees as a barrier to HTTPS adoption.
  • Open: the Let's Encrypt software is open source and can be reviewed for security and reliability.
  • Automated: automated issuance reduces manual intervention and administrative work.

2. What is acme.sh?​

acme.sh is an open-source ACME client written in shell script. It obtains certificates from ACME-compatible CAs such as Let's Encrypt and ZeroSSL.

  • Cross-platform: runs in supported shell environments on Linux, macOS, and Windows.
  • Easy to use: request, install, and renew certificates with command-line operations.
  • Flexible: HTTP and DNS validation support different network environments and server configurations.

3. Request a Let's Encrypt certificate with acme.sh​

1. Install acme.sh​

  • On Linux or macOS, install with:
curl https://get.acme.sh | sh
  • On Windows, the original guide provides this PowerShell installation command:
iwr https://get.acme.sh | iex

2. Issue a certificate​

Use either of these domain validation methods:

  • HTTP validation (webroot): Make sure your domain resolves to the correct server IP address. Request a certificate for example.com with:
~/.acme.sh/acme.sh --issue -d example.com --webroot /var/www/html/

Replace /var/www/html/ with your website's document root. acme.sh creates a .well-known/acme-challenge/ directory there and places a validation file in it to prove domain control.

  • DNS validation: Use DNS validation when HTTP validation is inconvenient or you need more flexibility. Configuration depends on your DNS provider. For Alibaba Cloud DNS:
~/.acme.sh/acme.sh --issue -d example.com --dns dns_ali

Set the parameters required by your DNS provider and ensure that the DNS records are configured correctly for validation.

3.Install the certificate​

After issuance, install the certificate for your web server. For NGINX:

~/.acme.sh/acme.sh --install-cert -d example.com \
  --key-file /path/to/nginx/key.pem \
  --fullchain-file /path/to/nginx/cert.pem

Replace /path/to/nginx/ with the actual NGINX configuration directory.

4. Renew automatically​

acme.sh attempts renewal automatically. You can also trigger it manually:

~/.acme.sh/acme.sh --renew -d example.com

These steps obtain a free SSL/TLS certificate from Let's Encrypt with acme.sh and configure HTTPS on your server.