acme.sh vs TigerTrust
acme.sh
github.com
TigerTrust
tigertrust.ioSide by side
| Figure | acme.sh | TigerTrust |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 4 |
| Spec score · Certificate Management Software | 8.3 (#7) | 7.0 (#25) |
| Purpose | acme.sh is a Unix shell script ACME client for SSL/TLS certificate automation. | TigerTrust is an enterprise PKI management platform for certificate lifecycle automation and machine identity security. |
| Security | Release tags from version 3.1.6 onward are signed with the maintainer's SSH key, while tags through 3.1.5 are unsigned. | The security page states that data in transit uses TLS 1.3 and data at rest uses AES-256, and that MFA is required for all users. |
| Support | The README directs users to the project's GitHub Issues and Pull Requests for discussion and contributions. | The support page lists standard email support with a 48-hour response time, professional 24-hour response, and enterprise 24/7 phone support with a one-hour response time. |
Plans
TigerTrust
- CustomPriced on request
- EnterprisePriced on request
- ProfessionalPriced on request
- StarterPriced on request
In their own words
acme.sh
acme.sh is a free Unix shell ACME client for automating SSL/TLS certificate issuance, renewal, and installation. Its installer creates a daily cron job to check certificates and renew them when needed. Written purely in shell, it is compatible with Bash, dash, and sh; the README says general use needs neither Python nor root or sudo access. It supports ECDSA, RSA, SAN, and wildcard certificates, with validation modes including webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist. ZeroSSL is the default certificate authority. Listed alternatives include Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA. The project says API integrations cover most DNS providers. Renewal uses a CA’s ACME Renewal Information when available, with a 30-day fallback rule otherwise. Manual DNS mode cannot renew automatically because each renewal requires a new TXT record to be added by hand. Tested systems listed include macOS, Windows through Cygwin, FreeBSD, and multiple Linux distributions. The project is GPLv3 licensed and officially maintained by ZeroSSL; release tags from version 3.1.6 onward are signed with the maintainer’s SSH key, while earlier tags are unsigned.
TigerTrust
TigerTrust has no write-up on Specifiction yet; its figures are above.