acmesh-official / acme.sh

📥 Install Online

Check this project: https://github.com/acmesh-official/get.acme.sh

curl https://get.acme.sh | sh -s email=my@example.com

Or:

wget -O -  https://get.acme.sh | sh -s email=my@example.com

📦 Install from Git

Clone this project and launch installation:

git clone https://github.com/acmesh-official/acme.sh.git
cd ./acme.sh
./acme.sh --install -m my@example.com

💡 You don't have to be root then, although it is recommended.

📚 Advanced Installation: https://github.com/acmesh-official/acme.sh/wiki/How-to-install

The installer will perform 3 actions:

1. Create and copy acme.sh to your home dir ($HOME): ~/.acme.sh/. All certs will be placed in this folder too.
2. Create alias for: acme.sh=~/.acme.sh/acme.sh.
3. Create daily cron job to check and renew the certs if needed.

Cron entry example:

0 0 * * * "/home/user/.acme.sh"/acme.sh --cron --home "/home/user/.acme.sh" > /dev/null

⚠️ After the installation, you must close the current terminal and reopen it to make the alias take effect.

✅ You are ready to issue certs now!

Show help message:

acme.sh -h

🔏 Verify a Release

Release tags from 3.1.6 on are signed with the maintainer's SSH key. The signing happens on the maintainer's machine, so the private key is never available to CI. The public half is allowed_signers in this repository. From a clone:

git config gpg.ssh.allowedSignersFile allowed_signers

git verify-tag 3.1.6

The signature covers the tag object, which pins the commit and therefore the whole tree, so a good signature verifies every file at that release and no separate tarball checksum is needed. Build a tarball from the verified tag:

git archive --format=tar.gz --prefix=acme.sh-3.1.6/ 3.1.6 > acme.sh-3.1.6.tar.gz

⚠️ Tags up to 3.1.5 are unsigned.

---