acme.sh
What it is
acme.sh is a free Unix shell client for automating SSL/TLS certificate work. It can issue, renew, and install certificates; its installer sets up a daily cron job to check whether renewal is due. The client works with Bash, dash, and sh, and general use does not require Python, root, or sudo. It supports ECDSA, RSA, SAN, and wildcard certificates, with validation options including webroot, standalone, Apache, Nginx, DNS, and DNS alias modes. ZeroSSL is the default certificate authority; listed alternatives include Let’s Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA. The project says API integrations cover most DNS providers. Renewal timing uses a CA’s ACME Renewal Information when available, or a 30-day fallback rule. Manual DNS mode cannot renew automatically because a new TXT record must be added for each renewal. The project lists Linux, macOS, self-hosted, and Windows support and is licensed under GPLv3.
For and against
For
- Free, GPLv3-licensed shell client.
- Issues, renews, and installs certificates automatically.
- Supports ECDSA, RSA, SAN, and wildcard certificates.
- Offers multiple validation modes and CA integrations.
Against
- Manual DNS mode cannot renew automatically.
- General support does not mean every system is listed as tested.
The verdict
acme.sh covers certificate issuance, installation, and renewal with several validation methods and certificate authorities. Its manual DNS mode requires a new TXT record at each renewal.
Who it suits
It suits people automating certificate issuance and renewal for Linux, macOS, self-hosted, or Windows environments. Manual DNS users should expect to add a TXT record for each renewal.
Plans and prices
acme.sh
GPLv3 · shell script ACME client
Read 7 Oct 2026 · github.com
On the record
- Certificate authorities
- The README lists ZeroSSL as the default CA and also lists Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA as supported.github.com · read 7 Oct 2026
- Certificate handling
- It can issue, renew, and install certificates automatically, with a daily cron job created by the installer to check and renew certificates when needed.github.com · read 7 Oct 2026
- Certificate types
- It supports ECDSA, RSA, SAN, and wildcard certificates.github.com · read 7 Oct 2026
- DNS integrations
- The project says it supports most DNS providers through API integrations and links to its DNS API list.github.com · read 7 Oct 2026
- Implementation
- The client is written purely in Unix shell and is compatible with Bash, dash, and sh.github.com · read 7 Oct 2026
- License and maintenance
- The repository is licensed under GPLv3 and says it is officially maintained by ZeroSSL, with donations going to original independent maintainer Neil Pang.github.com · read 7 Oct 2026
- Manual DNS limit
- DNS manual mode cannot renew automatically because a new TXT record must be added manually for each renewal.github.com · read 7 Oct 2026
- Operating systems
- The project lists tested systems including macOS, Windows through Cygwin, FreeBSD, and multiple Linux distributions.github.com · read 7 Oct 2026
- Purpose
- acme.sh is a Unix shell script ACME client for SSL/TLS certificate automation.github.com · read 7 Oct 2026
- Renewal behavior
- Certificates are renewed automatically, using a CA's ACME Renewal Information when available and a 30-day fallback rule otherwise.github.com · read 7 Oct 2026
- Runtime requirements
- The README says the client has no Python dependency and does not require root or sudo access for general use.github.com · read 7 Oct 2026
- Security
- Release tags from version 3.1.6 onward are signed with the maintainer's SSH key, while tags through 3.1.5 are unsigned.github.com · read 7 Oct 2026
- Support
- The README directs users to the project's GitHub Issues and Pull Requests for discussion and contributions.github.com · read 7 Oct 2026
- Validation modes
- Supported modes include webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist.github.com · read 7 Oct 2026
