Skip to content
SPECIFICTION
Get listed

acme.sh

github.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit github.com
Spec score 8.3 #7 of 31 in Certificate Management Software

What it is

acme.sh is a free Unix shell ACME client for automating SSL/TLS certificate issuance, renewal, and installation. Its installer creates a daily cron job to check certificates and renew them when needed. Written purely in shell, it is compatible with Bash, dash, and sh; the README says general use needs neither Python nor root or sudo access. It supports ECDSA, RSA, SAN, and wildcard certificates, with validation modes including webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist. ZeroSSL is the default certificate authority. Listed alternatives include Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA. The project says API integrations cover most DNS providers. Renewal uses a CA’s ACME Renewal Information when available, with a 30-day fallback rule otherwise. Manual DNS mode cannot renew automatically because each renewal requires a new TXT record to be added by hand. Tested systems listed include macOS, Windows through Cygwin, FreeBSD, and multiple Linux distributions. The project is GPLv3 licensed and officially maintained by ZeroSSL; release tags from version 3.1.6 onward are signed with the maintainer’s SSH key, while earlier tags are unsigned.

Spec sheet

Purpose
acme.sh is a Unix shell script ACME client for SSL/TLS certificate automation.Read 7 Oct 2026 · github.com
Security
Release tags from version 3.1.6 onward are signed with the maintainer's SSH key, while tags through 3.1.5 are unsigned.Read 7 Oct 2026 · github.com
Support
The README directs users to the project's GitHub Issues and Pull Requests for discussion and contributions.Read 7 Oct 2026 · github.com
Certificate authorities
The README lists ZeroSSL as the default CA and also lists Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA as supported.Read 7 Oct 2026 · github.com
Certificate handling
It can issue, renew, and install certificates automatically, with a daily cron job created by the installer to check and renew certificates when needed.Read 7 Oct 2026 · github.com
Certificate types
It supports ECDSA, RSA, SAN, and wildcard certificates.Read 7 Oct 2026 · github.com
DNS integrations
The project says it supports most DNS providers through API integrations and links to its DNS API list.Read 7 Oct 2026 · github.com
Implementation
The client is written purely in Unix shell and is compatible with Bash, dash, and sh.Read 7 Oct 2026 · github.com
License and maintenance
The repository is licensed under GPLv3 and says it is officially maintained by ZeroSSL, with donations going to original independent maintainer Neil Pang.Read 7 Oct 2026 · github.com
Manual DNS limit
DNS manual mode cannot renew automatically because a new TXT record must be added manually for each renewal.Read 7 Oct 2026 · github.com
Operating systems
The project lists tested systems including macOS, Windows through Cygwin, FreeBSD, and multiple Linux distributions.Read 7 Oct 2026 · github.com
Renewal behavior
Certificates are renewed automatically, using a CA's ACME Renewal Information when available and a 30-day fallback rule otherwise.Read 7 Oct 2026 · github.com
Runtime requirements
The README says the client has no Python dependency and does not require root or sudo access for general use.Read 7 Oct 2026 · github.com
Validation modes
Supported modes include webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist.Read 7 Oct 2026 · github.com

Plans and prices

acme.sh Free GPLv3 · shell script ACME client Read 7 Oct 2026 · github.com

Every acme.sh plan and price →

Strong points and limits

Strong points

  • Issues, renews, and installs certificates automatically.
  • Supports ECDSA, RSA, SAN, and wildcard certificates.
  • Offers multiple validation modes and certificate authorities.
  • General use does not require Python, root, or sudo.

Limits

  • Manual DNS mode cannot renew automatically.
  • Tags through version 3.1.5 are unsigned.

Who it suits

It suits users who want shell-based ACME certificate issuance and automatic renewal on supported systems. Those using manual DNS validation should be prepared to add a TXT record for every renewal.

Verdict

acme.sh provides certificate automation through a shell client with a broad set of validation modes. Manual DNS is the notable exception to automatic renewal.

Where Specifiction places it

Alternatives to acme.shAll alternatives →