Certbot vs. acme.sh — Choosing an ACME Client

Certbot and acme.sh are widely used ACME clients for issuing and managing certificates from CAs such as Let's Encrypt. This comparison helps you choose based on your environment and requirements.

1. Tool overview

1. Certbot

Developer: Electronic Frontier Foundation (EFF)

Features:

• An established ACME client
• Automatic configuration plugins for common web servers
• A straightforward command-line interface
• Extensive documentation and community support

2. acme.sh

Developer: Neilpang and the open-source community

Features:

• Written in shell script
• Lightweight, using standard shell utilities
• Integrations with many DNS providers
• Flexible configuration and deployment options

Feature comparison

1. Core features

Feature	Certbot	acme.sh
Certificate issuance	✅	✅
Automatic renewal	✅	✅
Automated deployment	✅	✅
DNS validation	✅	✅
HTTP validation	✅	✅
Wildcard certificates	✅	✅
Multi-domain certificates	✅	✅

2. Web-server support

Server	Certbot	acme.sh
NGINX	✅ Configuration plugin	⚠️ Manual configuration
Apache	✅ Configuration plugin	⚠️ Manual configuration
IIS	⚠️ Environment-dependent workflow	⚠️ Environment-dependent workflow
Other servers	⚠️ Plugin/workflow-dependent	✅ Flexible deployment hooks

3. DNS-provider integrations

DNS provider	Certbot	acme.sh
Cloudflare	✅	✅
Alibaba Cloud	⚠️ Plugin required	✅
Tencent Cloud	⚠️ Plugin required	✅
AWS Route 53	✅	✅
GoDaddy	⚠️ Plugin required	✅
Others	⚠️ Plugin-dependent	✅ Extensive provider support

3. Usability

1. Installation

Certbot：

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install certbot

# CentOS/RHEL
sudo yum install certbot

acme.sh：

# Install with the setup script.
curl https://get.acme.sh | sh

2. Certificate issuance

Certbot with HTTP validation:

sudo certbot certonly --webroot \
  -w /var/www/html \
  -d example.com

acme.sh with HTTP validation:

~/.acme.sh/acme.sh --issue \
  -d example.com \
  --webroot /var/www/html

3. Automatic server configuration

Certbot：

# Configure NGINX automatically.
sudo certbot --nginx -d example.com

# Configure Apache automatically.
sudo certbot --apache -d example.com

acme.sh：

• Does not provide the same automatic server-configuration workflow
• Configure the web server manually

Use cases

1. When to use Certbot

Suitable for:

• ✅ NGINX or Apache deployments
• ✅ Automatic web-server configuration
• ✅ Users new to ACME tools
• ✅ Standard server setups

Advantages:

• Automatic web-server configuration
• Established support and documentation
• Community support

2. When to use acme.sh

Suitable for:

• ✅ DNS validation workflows
• ✅ Nonstandard web-server setups
• ✅ Flexible configuration requirements
• ✅ Advanced users

Advantages:

• Integrations with more than 100 DNS providers in the original comparison
• Shell-based implementation using standard utilities
• Flexible configuration
• Extensive features

5. Detailed comparison

1. Installation and dependencies

Certbot：

• Requires a Python environment
• Can be installed through a package manager
• Has more runtime dependencies

acme.sh：

• Written in shell script
• Uses standard shell and cryptographic utilities
• Straightforward installation

2. Renewal automation

Certbot：

• Packages commonly install a systemd timer
• Renews before expiration according to the client and CA renewal policy
• Server configuration commonly requires root privileges

acme.sh：

• Installs a cron job
• Renews before expiration according to the client and CA renewal policy
• Can run without root after setup, subject to file and service permissions

3. Deployment

Certbot：

• Can install certificates for supported web servers
• Supports reload hooks
• Simple configuration

acme.sh：

• Configure installation paths or deployment scripts
• Supports custom deployment commands
• Flexible configuration

4. DNS validation

Certbot：

• Install a DNS plugin
• Supports major DNS providers through plugins
• Requires plugin-specific configuration

acme.sh：

• Includes a broad collection of DNS API integrations
• Simple configuration
• Supports many DNS providers

6. Examples

1. Certbot examples

Issue with HTTP validation:

sudo certbot certonly --webroot \
  -w /var/www/html \
  -d example.com \
  -d www.example.com

Issue with DNS validation:

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d example.com \
  -d *.example.com

Configure NGINX automatically:

sudo certbot --nginx \
  -d example.com \
  -d www.example.com

2. acme.sh examples

Issue with HTTP validation:

~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d www.example.com \
  --webroot /var/www/html

Issue with DNS validation:

export CF_Email="your-email@example.com"
export CF_Key="your-api-key"

~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d *.example.com \
  --dns dns_cf

Install a certificate:

~/.acme.sh/acme.sh --install-cert \
  -d example.com \
  --key-file /etc/nginx/ssl/key.pem \
  --fullchain-file /etc/nginx/ssl/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

Choosing an option

1. Choose Certbot when you

Suitable for:

• Use NGINX or Apache
• Want automatic server configuration
• Are new to ACME tools
• Have a standard deployment

2. Choose acme.sh when you

Suitable for:

• Need DNS validation
• Use a nonstandard web-server setup
• Need a particular DNS-provider integration
• Need flexible configuration
• Are comfortable with advanced configuration

3. Choose CertOne when you

Suitable for:

• Prefer not to use command-line tools
• Want a management dashboard
• Need automatic deployment to multiple nodes
• Need certificate monitoring
• Need centralized management of many certificates

Advantages:

• A web-based management interface
• Automatic renewal and deployment
• Certificate monitoring
• Multiple deployment methods

Best practices

1. Tool selection

• ✅ Standard server configuration: Certbot
• ✅ Broad DNS integrations: acme.sh
• ✅ Custom environments: acme.sh
• ✅ Dashboard-based management: CertOne

2. Certificate management

• ✅ Enable automatic renewal
• ✅ Set certificate expiration reminders
• ✅ Check certificate status regularly
• ✅ Back up certificates and private keys

3. Security configuration

• ✅ Use secure TLS protocols
• ✅ Configure security response headers
• ✅ Enable HSTS
• ✅ Keep the tools updated

Conclusion

Certbot and acme.sh both provide capable ACME workflows. Choose according to your server environment, automation needs, and familiarity with the tools.

Key points:

• ✅ Certbot: standard deployments with server-configuration plugins
• ✅ acme.sh: flexible configuration and broad DNS support
• ✅ CertOne: a management interface with automated operations

If you prefer a web interface, CertOne combines certificate management, renewal, deployment, and monitoring in one dashboard.

Automate your certificates with CertOne ↗

Issue free SSL/TLS certificates and automate renewal, deployment, and monitoring with CertOne. Connect your cloud services, servers, and containers from one dashboard.