acmesh-official/acme.sh on Hacker News

…regularly refresh the certificate they use by reading it from there. ---- [1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it) [2]…

comment by dspillett · 2026-10-16 · in What I self-host

…limited to TXT records. This seems to be a nice workaround ... and it is even already documented at https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

comment by mrl5 · 2026-07-10 · in TLS certificates for internal services done right

OP here. Actually I tried to use it but apparently prematurely -> https://github.com/acmesh-official/acme.sh/issues/7085#issue... Once it's supported I think my next iteration will be DNS persist + internal ip addresses on the public zone.…

comment by mrl5 · 2026-07-09 · in TLS certificates for internal services done right

…not able to dynamically update your 'primary' domain, but can update a secondary or sub-domain: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... So if "example.com" is control by Corporate IT, and they don't want 'random'…

comment by throw0101d · 2026-07-09 · in TLS certificates for internal services done right

…If you want only single host certificates, Actalis is Italian and issues free ones as well: https://github.com/acmesh-official/acme.sh/wiki/Actalis.com-...

comment by kassner · 2026-06-24 · in We’re making Bunny DNS free

acme.sh is maintained by ZeroSSL. https://github.com/acmesh-official/acme.sh#2%EF%B8%8F%E2%83%...

comment by curben · 2026-06-19 · in Let's Encrypt had a higher error rate for 90 minutes today

…oute53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.<SUB>.<DOMAIN>.<TLD>" } } } * https://github.com/acmesh-official/acme.sh/wiki/How-to-use-A... BIND 9 example: * https://dan.langille.org/2020/12/19/creating-a-very-spec…

comment by throw0101a · 2026-03-27 · in Installing a Let's Encrypt TLS certificate on a Brother printer with Certbot

…...but they also don't say how to specify the zone to be updated like acme.sh does: https://github.com/acmesh-official/acme.sh/blob/master/dnsap... So say you want a cert for *.foo.com, and you have: _acme-challenge.foo.com CNAME…

comment by jcalvinowens · 2026-03-25 · in You can run a DNS server (2025)

Works on my machine: git clone https://github.com/acmesh-official/acme.sh Cloning into 'acme.sh'... remote: Enumerating objects: 21361, done. remote: Counting objects: 100% (351/351), done. remote: Compressing objects: 100% (101/101),…

comment by Bender · 2026-01-22 · in Ask HN: Is GitHub Down?

…is a popular approach. If you need a stronger guarantee of uptime, reach for the paid options. https://github.com/acmesh-official/acme.sh?tab=readme-ov-fil...

comment by 8organicbits · 2025-08-26 · in SSL certificate requirements are becoming obnoxious

…you change the CNAMES and use a new domain whatever.tld as CNAME target. acme.sh supports this (see https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... this also works for wildcards as described there), most ACME clients do. I…

comment by andreashaerter · 2025-08-13 · in Nginx introduces native support for ACME protocol

…that remote code is executed and a glimpse into what the script is... it appears to be benign. " https://github.com/acmesh-official/acme.sh/issues/4659 It was not. Don't use acme.sh.

comment by _hyn3 · 2025-05-24

I was just digging into this a bit and discovered ACME supports a something called DNS alias mode ( https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... ) which allows you to add a static DNS TXT record on your core domain that…

comment by Yeroc · 2025-04-16 · in TLS certificate lifetimes will officially reduce to 47 days

…pretty big), and in a way it’s a testament to what’s possible in the language. Projects like https://github.com/acmesh-official/acme.sh really show the power of Bash. That and I think the project would need a name change, and discord.sh as…

comment by fieu · 2025-01-23 · in Bunster: Compile bash scripts to self contained executables

…but my favorite is the “acme.sh” script which is used to issue and renew certs from Lets Encrypt. https://github.com/acmesh-official/acme.sh/blob/master/acme....

comment by xyst · 2024-12-07 · in Biggest shell programs

…written purely in shell. It's extremely capable and supports DNS challenge and multiple providers https://github.com/acmesh-official/acme.sh

comment by ndsipa_pomu · 2024-11-20 · in Let's Encrypt is 10 years old now

…update which is great for home IP addresses that may change). Then, to get the certificates, I use https://github.com/acmesh-official/acme.sh which is a shell script that supports multiple certificate and DNS providers. Copying the…

comment by ndsipa_pomu · 2024-10-22 · in Just want simple TLS for your .internal network?

…even uses other providers by default. [0] https://acmeclients.com/certificate-authorities/ [1] https://github.com/acmesh-official/acme.sh/wiki/Change-defau...

comment by nucleardog · 2024-09-19 · in iOS 18 breaks IMAPS self-signed certs

acme.sh has a list in their Wiki: https://github.com/acmesh-official/acme.sh/wiki/CA

comment by psz · 2024-07-23 · in Intent to end OCSP service

…Acme.sh, a similar shell script ACME client, had a remote code execution problem last year. https://github.com/acmesh-official/acme.sh/issues/4668

comment by 8organicbits · 2024-04-20 · in Dehydrated: Letsencrypt/acme client implemented as a shell-script

Dehydrated and acme.sh seems different. Is one of them fork? https://github.com/acmesh-official/acme.sh https://github.com/dehydrated-io/dehydrated

comment by systemz · 2024-04-20 · in Dehydrated: Letsencrypt/acme client implemented as a shell-script

…certificates. ZeroSSL does not offer free wildcard certs [2] whereas LetsEncrypt does. [1] - https://github.com/acmesh-official/acme.sh [2] - https://zerossl.com/pricing/

comment by LinuxBender · 2024-03-20 · in Ask HN: What is your experience with ZeroSSL?

…and then silently failed after an automatic upgrade as recommended by the default install: https://github.com/acmesh-official/acme.sh/commit/2ce145f359... It's also cleared out my .account.conf files when run on the suggested cron. I've…

comment by Macha · 2024-01-30 · in Why Certificate Lifecycle Automation Matters

…via DNS verification. Apparently, the official client has support for the DNS API of 159 providers: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

comment by lgeorget · 2024-01-02 · in The Bureau of Meteorology website does not support connections via HTTPS

…client like dehydrated (or acme.sh): * https://packages.debian.org/search?keywords=dehydrated * https://github.com/acmesh-official/acme.sh Versus the official client certbot: * https://packages.debian.org/search?keywords=python3-certbot A…

comment by throw0101b · 2023-12-04 · in This is Fine

you may wish to use certbot instead: https://github.com/acmesh-official/acme.sh/issues/4659

comment by superq · 2023-10-13 · in HAProxy is not affected by the HTTP/2 Rapid Reset Attack

The thing I am missing the most is some kind of HTTP-01 by proxy, like https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mo... If DNS-01 is not an option or to complicated, this saves you from exposing a host to the internet for no…

comment by asimops · 2023-09-12 · in Caddy is the first and only web server to use HTTPS automatically and by default

…HiCA service. So it does sound like there is a closer link here than your comment would indicate: https://github.com/acmesh-official/acme.sh/issues/4659#issue...

comment by 0x0 · 2023-06-09 · in Acme.sh runs arbitrary commands from a remote server

Looks like they are issuing under a sub-CA of "ssl.com" according to https://github.com/acmesh-official/acme.sh/issues/4659#issue... Interestingly, the mozilla dev-security-policy group seems to contain a recent discussion about including…

comment by 0x0 · 2023-06-09 · in Acme.sh runs arbitrary commands from a remote server

…external dependencies are OpenSSL and cURL. The acme.sh shell ACME client is 8000 lines of shell: * https://github.com/acmesh-official/acme.sh The official Let's Encrypt client is written in Python, and the core 'executable' is much…

comment by throw0101c · 2023-03-11 · in Write Posix Shell

On the bright side, their move to snap finally provided me with the impetus to switch to acme.sh ( https://github.com/acmesh-official/acme.sh ) and it's been a much nicer experience.

comment by fanatic2pope · 2022-11-03 · in Snap Store administrators removed signal-desktop from Ubuntu Snap

…various DNS providers[2], and you can even create your own hook if there isn't already one[3]. [1] https://github.com/acmesh-official/acme.sh [2] https://github.com/acmesh-official/acme.sh/wiki/dnsapi [3]…

comment by losingom · 2022-08-21 · in Uacme: ACMEv2 client written in plain C with minimal dependencies

…testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh

comment by LinuxBender · 2022-08-21 · in Uacme: ACMEv2 client written in plain C with minimal dependencies

…Encrypt via DNS aliasing: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://news.ycombinator.com/item?id=28256326 (2020) Deep dive on how ACME DNS…

comment by throw0101a · 2022-06-16 · in NextDNS API

…2: https://eff-certbot.readthedocs.io/en/stable/using.html#dns-... 3: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

comment by tetha · 2022-04-12 · in Automate Public Certificates Lifecycle Management via RFC 8555 (ACME)

…mentioned I assume that the tools using LetsEncrypt will do their job. acme.sh in my case [1] [1] - https://github.com/Neilpang/acme.sh.git

comment by LinuxBender · 2022-04-11 · in Ask HN: Do you still monitor your SSL certificate validity?

…and supporting legacy servers with letsencrypt, and then I found acme.sh script to replace certbot: https://github.com/acmesh-official/acme.sh Simple and light without big dependencies as running in bash! I would recommend it a thousand…

comment by greatgib · 2022-02-21 · in Multiple vulnerabilities found in Snap-confine function on Linux systems

DNS alias mode: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... You want the name…

comment by throw0101a · 2022-02-09 · in Ask HN: What's your solution for SSL on internal servers?

…Consider using an ACME client written in shell: * https://github.com/dehydrated-io/dehydrated * https://github.com/acmesh-official/acme.sh There's a minor change for the pre/post-scripts to restart your web server, and telling the web…

comment by throw0101a · 2022-02-01 · in Does my site need HTTPS?

…somewhere else that you control: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... No A (or…

comment by throw0101a · 2022-01-05 · in Should you use Let's Encrypt for internal hostnames?

…a few providers that claim to be ACME conform, to be specific I took the list from the acme.sh: https://github.com/acmesh-official/acme.sh#supported-ca But it seems that acme.sh got bought by zero ssl, which would explain that it's their…

comment by tlamponi · 2021-11-25 · in LetsEncrypt Certificate Issuance Halted

…there's probably already support in LE for setup so you can just follow the instructions [here]( https://github.com/acmesh-official/acme.sh/wiki/dnsapi ) to provide the needed credentials. 3. Once the setup is complete, you should have a…

comment by jabbany · 2021-11-17 · in Chrome may start restricting requests to private networks

dns-01 is possible on Synology, but you need to SSH in: * https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS... * https://lippertmarkus.com/2020/03/14/synology-le-dns-auto-re... * http://www.thedreaming.org/2020/11/18/synology-let…

comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks

If your domain registry provides an API [1] you can automated local creation of certs: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... *…

comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks

…to external DNS, your team can use DNS validation to verify host record ownership for LE/ACME: * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... *…

comment by throw0101a · 2021-11-16 · in Chrome may start restricting requests to private networks

…create "Let's Encrypt" SSL certificates - creates and maintains directories with asterisks in them: https://github.com/acmesh-official/acme.sh/issues/1408 This is the sysadmin equivalent of piercing your nose just to make your parents mad.

comment by rsync · 2021-11-11 · in I'm “still afraid to use spaces in file names” years old

…domain registrars https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi . Another good thing is that one can move their registrations and change their…

comment by ignoramous · 2021-11-03 · in The Architecture of Open Source Applications: Nginx (2012)

…by a systemd timer and renews (using the DNS challenge) and deploys all expiring certificates. [1] https://github.com/acmesh-official/acme.sh

comment by mimimi31 · 2021-08-20 · in Another free CA as an alternative to Let's Encrypt

…this someone else posted a sibling comment about ACME DNS alias mode, which I had not heard of. https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... That's very close to good enough. Though it would still be nice if DNS…

comment by codetrotter · 2021-08-20 · in Another free CA as an alternative to Let's Encrypt

…which is also unsafe should the box get compromised. Are you aware of LE/ACME's "DNS alias" mode? * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... Let us…

comment by throw0101a · 2021-08-20 · in Another free CA as an alternative to Let's Encrypt