acme.sh

What acme.sh actually is

acme.sh is an ACME protocol client written entirely in Unix shell — one script, no Python, no compiled binary, no plugin packages. It automates the full certificate lifecycle: request a certificate from a Certificate Authority, prove control of the domain, receive the certificate, install it to wherever your services need it, and renew it before it expires. Its repository was created on 26 December 2015 and the project is licensed GPLv3, currently at version 3.x with roughly 6,900 commits and about 46,000 GitHub stars — by deployment count one of the two dominant ACME clients alongside Certbot.

In our SSL certificates category we treat acme.sh differently from the paid certificate sellers, because it does not sell certificates at all. It is a free tool that talks to whatever ACME-capable CA you point it at: Let's Encrypt, ZeroSSL (the default CA in current versions), Google Trust Services, SSL.com, and Actalis all have built-in shortcuts. The certificates it produces are ordinary CA-issued certificates — identical browser trust to anything bought — so the question is not quality of the certificate but quality of the automation around it.

The design philosophy is portability. The script runs on a remarkable range of systems — Linux distributions, the BSDs, macOS, Solaris, Windows, various embedded and illumos-derived systems — and is compatible with bash, dash, and plain sh. It installs into ~/.acme.sh/, registers its own daily cron (or systemd/Windows scheduler) entry, and does not require root to run, though root is recommended for install steps that touch system paths. That combination is why it turns up everywhere from Raspberry Pis and NAS boxes to bare-metal fleets: where Certbot drags a Python runtime and per-provider plugin packages with it, acme.sh is a folder of shell functions.

Pricing: what you really pay

There is nothing to pay. acme.sh is free software under the GNU GPL version 3, funded historically by donations and, since around 2024, officially maintained by ZeroSSL as part of that company's open-source commitment. The certificates it obtains are also free from Let's Encrypt, Google Trust Services, and ZeroSSL's free tier; SSL.com and other CAs may charge for their products, which is a matter between you and the CA, not the client.

The real costs are operational, and we would rather name them than pretend "free" means zero. First, DNS API credentials: for wildcard certificates and DNS-01 validation you configure an API token for your DNS provider and store it on the server that performs renewals — a scoped token limits the blast radius if that host is compromised, and we recommend scoping it to one zone. Second, the GPL: if you embed acme.sh inside a commercial appliance or closed product, copyleft obligations apply and legal review is your problem, not the project's. Third, your time: acme.sh assumes you know what a challenge, a chain, and a deploy hook are. There is no support contract behind it — help comes from the wiki, GitHub issues, and a Gitter chat.

Performance & infrastructure

There are no servers to benchmark here — the client runs on your infrastructure — so the meaningful performance questions are footprint and speed of automation. On footprint acme.sh is close to the floor: a shell script plus its function libraries, minimal enough for routers and containers. On automation, the feature set is deep. Challenge types cover HTTP-01, DNS-01, TLS-ALPN-01, and a draft DNS-persist mode; certificates support SAN (multiple names) and wildcard issuance, RSA and ECDSA keys (ECDSA is the default for account and domain keys in current versions), and preferred-chain selection.

The DNS integration story is the standout. Provider logic lives in dnsapi/ functions named dns_<provider> — Cloudflare, DigitalOcean, Route 53, Azure DNS, GoDaddy, Gandi, Hetzner, Porkbun, Namecheap, Hurricane Electric, nsupdate and many more — selected with a single --dns dns_cf-style flag and environment variables for credentials. Third-party counts of supported providers range from "100+ built-in" to "over 170", and the project itself says "most DNS providers" without publishing a number; our database previously claimed 200+, which we could not verify and have corrected downward. There is also a documented API for writing your own provider function, a DNS alias mode that keeps validation records off the production zone, and a stateless mode for hosts where you cannot manipulate DNS at all.

Renewal is handled by a daily cron check against a renewal window (30 days before expiry by default), and deploy hooks install certificates to nginx, Apache, HAProxy, routers, and other targets with a --reloadcmd for service reloads. Multi-CA support is a practical reliability feature rather than trivia: when Let's Encrypt rate-limits you, --server zerossl moves issuance to another CA while your renewal timer and deploy hooks stay unchanged. Note that older documentation mentioning Buypass is aging out — Buypass stopped issuing free certificates in October 2025 and shut down its ACME service in April 2026.

Where it falls short

acme.sh is a power-user tool wearing a friendly README. The "3 minutes to learn" claim holds for the single-domain HTTP-01 case; anything beyond that means learning flag conventions, environment variables, and the quirks of DNS-01 propagation timing. Error output is shell-script error output. If you want a tool that reconfigures your web server automatically and holds your hand, Certbot's Apache/Nginx plugins or a built-in-ACME server like Caddy remain easier first experiences. The documentation is a wiki rather than a curated manual: thorough in places, uneven in others, and occasionally a release behind the code.

The configuration model deserves a word too. Everything is environment variables and flags — CF_Token, DO_API_KEY, --dns dns_cf, --reloadcmd — which scripts beautifully and reads poorly in a team setting unless you wrap it in your own tooling. Secrets live in the shell environment of the renewing job, so however you inject them (systemd credentials, a secrets manager, an encrypted file) becomes part of your certificate pipeline design.

The support model has no floor. There is no SLA, no guaranteed response on GitHub issues, and no vendor to escalate to when a renewal breaks at 2am on a holiday. For infrastructure where certificate expiry means an outage, the responsible pattern is monitoring — alert on certificate age regardless of which client renews it — and keeping a documented manual issuance path. We say the same to anyone running Certbot; the difference is that Certbot has an institution (the EFF) behind its maintenance.

Project structure is a second consideration: despite the breadth of contributions, the maintainer concentration around Neil Pang is high, and the ZeroSSL stewardship arrangement is recent. GPLv3 licensing may also matter for commercial embedding. And the installation idiom — curl https://get.acme.sh | sh — is convenient in a way that deserves the standard caveat: for production use, clone the repository, verify what you are running, and pin a release.

Who should pick this

We would pick acme.sh for scripted infrastructure: fleets of servers, embedded devices, reverse proxies, containers, and any environment where Python is unwelcome or absent. It is our pick when you manage certificates across many domains and DNS providers, need wildcard automation, want to switch CAs without retooling, or need TLS-ALPN-01 for services that are not HTTP. Teams running NAS boxes, routers, and homelab services alongside production hosts value that the same script works in all of them.

We would point beginners on a standard Linux web server toward Certbot or an ACME-native server instead, and we would point anyone needing contractual support toward a commercial certificate management platform. If you choose acme.sh, use scoped DNS tokens, pin your release, verify the installer, and monitor certificate expiry externally.

Key takeaways

• Free GPLv3 ACME client in pure shell (repo created December 2015) — no Python, no plugins, runs without root on Linux, BSDs, macOS, Solaris, Windows and embedded systems.
• Works with Let's Encrypt, ZeroSSL (default CA), Google Trust Services, SSL.com and Actalis; switching CA is one --server flag.
• Broadest DNS-01 automation available: 100–170+ built-in provider functions (our earlier "200+" claim was unverified), plus DNS alias and stateless modes.
• Wildcards, SANs, RSA/ECDSA (ECDSA default), HTTP-01, DNS-01, TLS-ALPN-01, daily auto-renew cron, and deploy hooks with service reloads.
• Zero license cost; the real costs are DNS API credential management, GPL obligations for embedding, and the absence of any support SLA.
• Best fit: scripted and constrained environments; less comfortable for first-time users who want guided web-server configuration — and monitor certificate expiry yourself either way.

Sources

• https://github.com/acmesh-official/acme.sh
• https://github.com/acmesh-official/acme.sh/blob/master/LICENSE.md
• https://raw.githubusercontent.com/Neilpang/acme.sh/master/acme.sh
• https://pistack.xyz/posts/2026-04-27-certbot-vs-acme-sh-vs-lego-vs-dehydrated-self-hosted-acme-dns-challenge-guide-2026
• https://sslinsights.com/certbot-vs-acme-sh
• https://awkto.dev/blog/acme-sh-is-underrated
• https://vpsdime.com/knowledgebase/getting-started/ssl-certificates
• https://certimon.com/buypass-go-ssl