acme.sh vs lego
acme.sh
github.com
lego
go-acme.github.ioSide by side
| Figure | acme.sh | lego |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Certificate Management Software | 8.3 (#7) | 8.5 (#6) |
| Certificate authorities | The README lists ZeroSSL as the default CA and also lists Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA as supported. | It supports multiple ACME servers, including Let’s Encrypt and ZeroSSL. |
| Certificate types | It supports ECDSA, RSA, SAN, and wildcard certificates. | It supports wildcard and SAN certificates. |
| DNS integrations | The project says it supports most DNS providers through API integrations and links to its DNS API list. | The project says it supports more than 200 DNS providers, with a provider list in its documentation. |
| Purpose | acme.sh is a Unix shell script ACME client for SSL/TLS certificate automation. | lego is an ACME client and library written in Go for obtaining and renewing certificates. |
| Support | The README directs users to the project's GitHub Issues and Pull Requests for discussion and contributions. | The project links to GitHub issues and discussions for help and community participation. |
Plans
In their own words
acme.sh
acme.sh is a free Unix shell ACME client for automating SSL/TLS certificate issuance, renewal, and installation. Its installer creates a daily cron job to check certificates and renew them when needed. Written purely in shell, it is compatible with Bash, dash, and sh; the README says general use needs neither Python nor root or sudo access. It supports ECDSA, RSA, SAN, and wildcard certificates, with validation modes including webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist. ZeroSSL is the default certificate authority. Listed alternatives include Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA. The project says API integrations cover most DNS providers. Renewal uses a CA’s ACME Renewal Information when available, with a 30-day fallback rule otherwise. Manual DNS mode cannot renew automatically because each renewal requires a new TXT record to be added by hand. Tested systems listed include macOS, Windows through Cygwin, FreeBSD, and multiple Linux distributions. The project is GPLv3 licensed and officially maintained by ZeroSSL; release tags from version 3.1.6 onward are signed with the maintainer’s SSH key, while earlier tags are unsigned.
lego
lego is an independent, free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates and can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL. Validation choices include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01. The project lists more than 200 DNS providers, including Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS, with CNAME support enabled by default. Users can run lego from the command line or call it as a Go library. DNS credentials and settings are supplied through environment variables, with file references and dotenv files supported. Installation options include prebuilt binaries, Docker, package managers, and source. The maintainers look after the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and certificate validation and renewal extensions. It is licensed under MIT, and installing from source requires Go 1.25 or later. The project points to GitHub issues and discussions for help.