acme.sh

acme.sh is a command-line client for automating SSL/TLS certificates, aimed at administrators who are comfortable working with shell scripts. Its breadth of validation methods and certificate authority options makes it adaptable; manual DNS validation is the notable snag for anyone expecting every renewal to run unattended.

Overview

Written in Unix shell and compatible with Bash, dash, and sh, acme.sh issues, installs, and renews certificates. The installer sets up a daily cron job to check whether certificates need renewal. No Python dependency and no general requirement for root or sudo access make it a practical fit for lean server environments where administrators want to keep certificate management scriptable.

It supports RSA, ECDSA, SAN, and wildcard certificates. ZeroSSL is the default certificate authority, with Let's Encrypt, SSL.com, Google Public CA, Actalis, Pebble strict mode, and any RFC8555-compliant CA also supported. This flexibility helps when a deployment needs a particular CA or certificate type, while the range of choices means administrators should select settings that match their environment.

Key features

Validation and renewal

Validation options include webroot, standalone, standalone TLS-ALPN, Apache, Nginx, DNS, DNS alias, stateless, and DNS persist. That range suits varied server and DNS arrangements, including setups that need DNS-based validation. DNS API integrations cover most providers, giving users a path to automate DNS validation through provider APIs.

Renewal follows a CA's ACME Renewal Information when available, with a 30-day fallback rule otherwise. Manual DNS mode is the exception: each renewal needs a new TXT record added by hand. It is therefore a poor match for anyone who needs fully unattended renewals and cannot automate DNS another way.

Portability and maintenance

The project lists tested systems across Linux distributions, macOS, FreeBSD, and Windows through Cygwin. Its platform range also includes self-hosted environments. Release tags from version 3.1.6 onward are signed with the maintainer's SSH key; tags through 3.1.5 are unsigned. The repository is GPLv3-licensed and officially maintained by ZeroSSL, with donations directed to original independent maintainer Neil Pang. Project discussion and contributions go through GitHub Issues and Pull Requests.

Pricing

acme.sh is free: the acme.sh plan costs nothing and is GPLv3 licensed. There is no paid tier to unlock its certificate handling capabilities. The trade-off is operational rather than financial: choosing manual DNS validation leaves a recurring TXT-record task with the administrator.

Platforms

acme.sh is available for Linux, macOS, self-hosted use, and Windows. The project specifically lists Windows through Cygwin among tested systems, so Windows users should expect to use that environment.

Who it's for

acme.sh is best suited to technically confident administrators who want a free shell-based client, need a choice of certificate authorities or validation methods, and can manage a cron-based workflow. It is less suitable for people who want manual DNS validation but cannot handle a new TXT record at each renewal, or who prefer a certificate workflow that does not depend on command-line administration.

Pros and cons

• Pros: Broad validation support and DNS API integrations make it adaptable to different hosting and DNS setups.
• Pros: Automatic issuance, installation, and renewal, plus no Python dependency and no general root or sudo requirement, suit lean server workflows.
• Pros: Free GPLv3 licensing and support for multiple CAs and certificate types offer flexibility without a plan fee.
• Cons: Manual DNS validation requires a fresh TXT record for every renewal, preventing a fully automatic workflow in that mode.
• Cons: Windows support is through Cygwin, which makes it a less direct fit for administrators seeking a native Windows workflow.

Alternatives

For a broader directory of options, browse Certificate Management Software.

Certify The Web is worth considering for users who want a free evaluation with no feature limitations and no time limit, alongside a freemium model and a wider platform range that includes web. Certbot is another free option for readers who prefer software made by the Electronic Frontier Foundation. lego suits readers looking for an independent free and open-source project with no paid plans stated.

Let's Encrypt is a direct alternative for readers seeking free Domain Validation certificates from that certificate authority. GeoTrust suits readers considering paid SSL offerings that include AutoInstall SSL with certificates and an SSL Monitor plan priced at $2 a month per standard domain. EJBCA offers a free Community Edition for basic PKI functionality aimed at learning, testing, and prototyping, rather than production use. OpenXPKI is an option for readers seeking a free, fully functional Community Edition with Debian packages, example configuration, documentation, and mailing-list support. Qualys External Attack Surface Management offers a 30-day no-cost trial of CyberSecurity Asset Management with EASM.

Verdict

Choose acme.sh if you can work comfortably in a shell and want free, flexible certificate automation with a choice of CAs and validation methods. Its main advantage is that range combined with automatic installation and renewal; look elsewhere if manual DNS is your only workable validation path and you need renewals to happen without human intervention.