Hacker GitHub

← All repos

acmesh-official/acme.sh

View on GitHub ↗ ★ 47,905 Shell

A pure Unix shell script ACME client for SSL / TLS certificate automation

92 mentions on Hacker News by 65 people: 10 stories, 82 comments · first 2016-04-14 · latest 2026-10-16

Mentions per year 92 mentions · busiest year 2020 (16)
20082026
AllStoriesComments NewestTopOldest
  1. …regularly refresh the certificate they use by reading it from there. ---- [1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it) [2]…
    comment by dspillett · 2026-10-16 · in What I self-host
  2. …limited to TXT records. This seems to be a nice workaround ... and it is even already documented at https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...
    comment by mrl5 · 2026-07-10 · in TLS certificates for internal services done right
  3. OP here. Actually I tried to use it but apparently prematurely -> https://github.com/acmesh-official/acme.sh/issues/7085#issue... Once it's supported I think my next iteration will be DNS persist + internal ip addresses on the public zone.…
    comment by mrl5 · 2026-07-09 · in TLS certificates for internal services done right
  4. …not able to dynamically update your 'primary' domain, but can update a secondary or sub-domain: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... So if "example.com" is control by Corporate IT, and they don't want 'random'…
    comment by throw0101d · 2026-07-09 · in TLS certificates for internal services done right
  5. …If you want only single host certificates, Actalis is Italian and issues free ones as well: https://github.com/acmesh-official/acme.sh/wiki/Actalis.com-...
    comment by kassner · 2026-06-24 · in We’re making Bunny DNS free
  6. acme.sh is maintained by ZeroSSL. https://github.com/acmesh-official/acme.sh#2%EF%B8%8F%E2%83%...
    comment by curben · 2026-06-19 · in Let's Encrypt had a higher error rate for 90 minutes today
  7. …oute53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.<SUB>.<DOMAIN>.<TLD>" } } } * https://github.com/acmesh-official/acme.sh/wiki/How-to-use-A... BIND 9 example: * https://dan.langille.org/2020/12/19/creating-a-very-spec…
    comment by throw0101a · 2026-03-27 · in Installing a Let's Encrypt TLS certificate on a Brother printer with Certbot
  8. …...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME…
    comment by jcalvinowens · 2026-03-25 · in You can run a DNS server (2025)
  9. Works on my machine: git clone https://github.com/acmesh-official/acme.sh Cloning into 'acme.sh'... remote: Enumerating objects: 21361, done. remote: Counting objects: 100% (351/351), done. remote: Compressing objects: 100% (101/101),…
    comment by Bender · 2026-01-22 · in Ask HN: Is GitHub Down?
  10. …is a popular approach. If you need a stronger guarantee of uptime, reach for the paid options. https://github.com/acmesh-official/acme.sh?tab=readme-ov-fil...
    comment by 8organicbits · 2025-08-26 · in SSL certificate requirements are becoming obnoxious
  11. …you change the CNAMES and use a new domain whatever.tld as CNAME target. acme.sh supports this (see https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... this also works for wildcards as described there), most ACME clients do. I…
    comment by andreashaerter · 2025-08-13 · in Nginx introduces native support for ACME protocol
  12. …that remote code is executed and a glimpse into what the script is... it appears to be benign. " https://github.com/acmesh-official/acme.sh/issues/4659 It was not. Don't use acme.sh.
    comment by _hyn3 · 2025-05-24
  13. I was just digging into this a bit and discovered ACME supports a something called DNS alias mode ( https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... ) which allows you to add a static DNS TXT record on your core domain that…
    comment by Yeroc · 2025-04-16 · in TLS certificate lifetimes will officially reduce to 47 days
  14. …pretty big), and in a way it’s a testament to what’s possible in the language. Projects like https://github.com/acmesh-official/acme.sh really show the power of Bash. That and I think the project would need a name change, and discord.sh as…
    comment by fieu · 2025-01-23 · in Bunster: Compile bash scripts to self contained executables
  15. …but my favorite is the “acme.sh” script which is used to issue and renew certs from Lets Encrypt. https://github.com/acmesh-official/acme.sh/blob/master/acme....
    comment by xyst · 2024-12-07 · in Biggest shell programs
  16. …written purely in shell. It's extremely capable and supports DNS challenge and multiple providers https://github.com/acmesh-official/acme.sh
    comment by ndsipa_pomu · 2024-11-20 · in Let's Encrypt is 10 years old now
  17. …update which is great for home IP addresses that may change). Then, to get the certificates, I use https://github.com/acmesh-official/acme.sh which is a shell script that supports multiple certificate and DNS providers. Copying the…
    comment by ndsipa_pomu · 2024-10-22 · in Just want simple TLS for your .internal network?
  18. …even uses other providers by default. [0] https://acmeclients.com/certificate-authorities/ [1] https://github.com/acmesh-official/acme.sh/wiki/Change-defau...
    comment by nucleardog · 2024-09-19 · in iOS 18 breaks IMAPS self-signed certs
  19. acme.sh has a list in their Wiki: https://github.com/acmesh-official/acme.sh/wiki/CA
    comment by psz · 2024-07-23 · in Intent to end OCSP service
  20. …Acme.sh, a similar shell script ACME client, had a remote code execution problem last year. https://github.com/acmesh-official/acme.sh/issues/4668
    comment by 8organicbits · 2024-04-20 · in Dehydrated: Letsencrypt/acme client implemented as a shell-script
  21. Dehydrated and acme.sh seems different. Is one of them fork? https://github.com/acmesh-official/acme.sh https://github.com/dehydrated-io/dehydrated
    comment by systemz · 2024-04-20 · in Dehydrated: Letsencrypt/acme client implemented as a shell-script
  22. …certificates. ZeroSSL does not offer free wildcard certs [2] whereas LetsEncrypt does. [1] - https://github.com/acmesh-official/acme.sh [2] - https://zerossl.com/pricing/
    comment by LinuxBender · 2024-03-20 · in Ask HN: What is your experience with ZeroSSL?
  23. ▲ 3
    Ask HN: What is your experience with ZeroSSL?
    story by grodriguez100 · 2024-03-20 · 7 comments
  24. ▲ 1
    Ask HN: What is your experience with ZeroSSL?
    story by grodriguez100 · 2024-03-19 · 0 comments
  25. …and then silently failed after an automatic upgrade as recommended by the default install: https://github.com/acmesh-official/acme.sh/commit/2ce145f359... It's also cleared out my .account.conf files when run on the suggested cron. I've…
    comment by Macha · 2024-01-30 · in Why Certificate Lifecycle Automation Matters
  26. …via DNS verification. Apparently, the official client has support for the DNS API of 159 providers: https://github.com/acmesh-official/acme.sh/wiki/dnsapi
    comment by lgeorget · 2024-01-02 · in The Bureau of Meteorology website does not support connections via HTTPS
  27. …client like dehydrated (or acme.sh): * https://packages.debian.org/search?keywords=dehydrated * https://github.com/acmesh-official/acme.sh Versus the official client certbot: * https://packages.debian.org/search?keywords=python3-certbot A…
    comment by throw0101b · 2023-12-04 · in This is Fine
  28. you may wish to use certbot instead: https://github.com/acmesh-official/acme.sh/issues/4659
    comment by superq · 2023-10-13 · in HAProxy is not affected by the HTTP/2 Rapid Reset Attack
  29. The thing I am missing the most is some kind of HTTP-01 by proxy, like https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mo... If DNS-01 is not an option or to complicated, this saves you from exposing a host to the internet for no…
    comment by asimops · 2023-09-12 · in Caddy is the first and only web server to use HTTPS automatically and by default
  30. …HiCA service. So it does sound like there is a closer link here than your comment would indicate: https://github.com/acmesh-official/acme.sh/issues/4659#issue...
    comment by 0x0 · 2023-06-09 · in Acme.sh runs arbitrary commands from a remote server
  31. Looks like they are issuing under a sub-CA of "ssl.com" according to https://github.com/acmesh-official/acme.sh/issues/4659#issue... Interestingly, the mozilla dev-security-policy group seems to contain a recent discussion about including…
    comment by 0x0 · 2023-06-09 · in Acme.sh runs arbitrary commands from a remote server
  32. ▲ 291
    Acme.sh runs arbitrary commands from a remote server
    story by Kesseki · 2023-06-09 · 67 comments
  33. …external dependencies are OpenSSL and cURL. The acme.sh shell ACME client is 8000 lines of shell: * https://github.com/acmesh-official/acme.sh The official Let's Encrypt client is written in Python, and the core 'executable' is much…
    comment by throw0101c · 2023-03-11 · in Write Posix Shell
  34. On the bright side, their move to snap finally provided me with the impetus to switch to acme.sh ( https://github.com/acmesh-official/acme.sh ) and it's been a much nicer experience.
    comment by fanatic2pope · 2022-11-03 · in Snap Store administrators removed signal-desktop from Ubuntu Snap
  35. …various DNS providers[2], and you can even create your own hook if there isn't already one[3]. [1] https://github.com/acmesh-official/acme.sh [2] https://github.com/acmesh-official/acme.sh/wiki/dnsapi [3]…
    comment by losingom · 2022-08-21 · in Uacme: ACMEv2 client written in plain C with minimal dependencies
  36. …testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh
    comment by LinuxBender · 2022-08-21 · in Uacme: ACMEv2 client written in plain C with minimal dependencies
  37. …Encrypt via DNS aliasing: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://news.ycombinator.com/item?id=28256326 (2020) Deep dive on how ACME DNS…
    comment by throw0101a · 2022-06-16 · in NextDNS API
  38. …2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi
    comment by tetha · 2022-04-12 · in Automate Public Certificates Lifecycle Management via RFC 8555 (ACME)
  39. …mentioned I assume that the tools using LetsEncrypt will do their job. acme.sh in my case [1] [1] - https://github.com/Neilpang/acme.sh.git
    comment by LinuxBender · 2022-04-11 · in Ask HN: Do you still monitor your SSL certificate validity?
  40. …and supporting legacy servers with letsencrypt, and then I found acme.sh script to replace certbot: https://github.com/acmesh-official/acme.sh Simple and light without big dependencies as running in bash! I would recommend it a thousand…
    comment by greatgib · 2022-02-21 · in Multiple vulnerabilities found in Snap-confine function on Linux systems
  41. DNS alias mode: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... You want the name…
    comment by throw0101a · 2022-02-09 · in Ask HN: What's your solution for SSL on internal servers?
  42. …Consider using an ACME client written in shell: * https://github.com/dehydrated-io/dehydrated * https://github.com/acmesh-official/acme.sh There's a minor change for the pre/post-scripts to restart your web server, and telling the web…
    comment by throw0101a · 2022-02-01 · in Does my site need HTTPS?
  43. …somewhere else that you control: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... No A (or…
    comment by throw0101a · 2022-01-05 · in Should you use Let's Encrypt for internal hostnames?
  44. …a few providers that claim to be ACME conform, to be specific I took the list from the acme.sh: https://github.com/acmesh-official/acme.sh#supported-ca But it seems that acme.sh got bought by zero ssl, which would explain that it's their…
    comment by tlamponi · 2021-11-25 · in LetsEncrypt Certificate Issuance Halted
  45. …there's probably already support in LE for setup so you can just follow the instructions [here]( https://github.com/acmesh-official/acme.sh/wiki/dnsapi ) to provide the needed credentials. 3. Once the setup is complete, you should have a…
    comment by jabbany · 2021-11-17 · in Chrome may start restricting requests to private networks
  46. dns-01 is possible on Synology, but you need to SSH in: * https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS... * https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re... * http://www.thedreaming.org/2020/11/18/synology-let…
    comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks
  47. If your domain registry provides an API [1] you can automated local creation of certs: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... *…
    comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks
  48. …to external DNS, your team can use DNS validation to verify host record ownership for LE/ACME: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... *…
    comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks
  49. …create "Let's Encrypt" SSL certificates - creates and maintains directories with asterisks in them: https://github.com/acmesh-official/acme.sh/issues/1408 This is the sysadmin equivalent of piercing your nose just to make your parents mad.
    comment by rsync · 2021-11-11 · in I'm “still afraid to use spaces in file names” years old
  50. …domain registrars https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi . Another good thing is that one can move their registrations and change their…
    comment by ignoramous · 2021-11-03 · in The Architecture of Open Source Applications: Nginx (2012)