{"id":9279,"date":"2019-02-07T22:18:54","date_gmt":"2019-02-07T22:18:54","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/?p=9279"},"modified":"2019-02-10T07:02:28","modified_gmt":"2019-02-10T07:02:28","slug":"getting-started-with-acme-sh-lets-encrypt-ssl-client","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/02\/07\/getting-started-with-acme-sh-lets-encrypt-ssl-client\/","title":{"rendered":"Getting started with acme.sh Let&#8217;s Encrypt SSL client"},"content":{"rendered":"<p>Acme.sh\u00a0is a simple, powerful and easy to use\u00a0ACME\u00a0protocol client written purely in Shell (Unix shell) language, compatible with bash, dash, and sh shells. It helps\u00a0manage installation, renewal, revocation of SSL certificates.\u00a0It supports ACME version 1 and ACME version 2 protocols, as well as ACME v2 wildcard certificates. Being a zero dependencies ACME client makes it even better. You don&#8217;t need to download and install the whole internet to\u00a0make it running. The tool does not require root or sudo access, but it&#8217;s\u00a0recommended to use root.<\/p>\n<p>Acme.sh supports the following validation methods that you can use to\u00a0confirm domain ownership:<\/p>\n<ul>\n<li>Webroot mode<\/li>\n<li>Standalone mode<\/li>\n<li>Standalone tls-alpn mode<\/li>\n<li>Apache mode<\/li>\n<li>Nginx mode<\/li>\n<li>DNS mode<\/li>\n<li>DNS alias mode<\/li>\n<li>Stateless mode<\/li>\n<\/ul>\n<h2 id=\"what-is-lets-encrypt\">What is Let&#8217;s Encrypt<\/h2>\n<p>Let\u2019s Encrypt (LE) is a certificate authority (CA) and project that offers free and automated SSL\/TLS certificates, with the\u00a0goal\u00a0of encrypting the entire web. If you own a domain name and have shell access to your server you can\u00a0utilize\u00a0Let&#8217;s Encrypt\u00a0to obtain a trusted certificate at\u00a0no cost. Let&#8217;s Encrypt can issue SAN certs\u00a0for up to\u00a0100 hostnames<strong>\u00a0<\/strong>and wildcard certificates. All certs are\u00a0valid for the period of\u00a090 days.<\/p>\n<h2 id=\"acmesh-usage-and-basic-commands\">Acme.sh usage and basic commands<\/h2>\n<p>In this section, I will show some of the most common\u00a0acme.sh commands and options.<\/p>\n<h3 id=\"acmesh-installation\">Acme.sh installation<\/h3>\n<p>You have a few options to install acme.sh.<\/p>\n<p><strong>Install\u00a0from web\u00a0via\u00a0<code>curl<\/code>\u00a0or\u00a0<code>wget<\/code><\/strong>:<\/p>\n<pre class=\"command\"><code>curl https:\/\/get.acme.sh | sh\r\nsource ~\/.bashrc<\/code><\/pre>\n<p>or<\/p>\n<pre class=\"command\"><code>wget -O - https:\/\/get.acme.sh | sh\r\nsource ~\/.bashrc<\/code><\/pre>\n<p><strong>Install from GitHub<\/strong>:<\/p>\n<pre class=\"command\"><code>curl https:\/\/raw.githubusercontent.com\/Neilpang\/acme.sh\/master\/acme.sh | INSTALLONLINE=1 sh<\/code><\/pre>\n<p>or<\/p>\n<pre class=\"command\"><code>wget -O - https:\/\/raw.githubusercontent.com\/Neilpang\/acme.sh\/master\/acme.sh | INSTALLONLINE=1 sh<\/code><\/pre>\n<p><strong>Git clone and install:<\/strong><\/p>\n<pre class=\"command\"><code>git clone https:\/\/github.com\/Neilpang\/acme.sh.git\r\ncd .\/acme.sh\r\n.\/acme.sh --install\r\nsource ~\/.bashrc<\/code><\/pre>\n<p>The installer will perform 3 actions:<\/p>\n<ol>\n<li>Create and copy\u00a0<code>acme.sh<\/code>\u00a0to your home dir (<code>$HOME<\/code>):\u00a0<code>~\/.acme.sh\/<\/code>. All certs will be placed in this folder too.<\/li>\n<li>Create alias for:\u00a0<code>acme.sh=~\/.acme.sh\/acme.sh<\/code>.<\/li>\n<li>Create daily cron job to check and renew the certs if needed.<\/li>\n<\/ol>\n<p><strong>Advanced installation:<\/strong><\/p>\n<pre class=\"command\"><code>git clone https:\/\/github.com\/Neilpang\/acme.sh.git\r\ncd acme.sh\r\n.\/acme.sh --install \\\r\n          --home ~\/myacme \\\r\n          --config-home ~\/myacme\/data \\\r\n          --cert-home ~\/mycerts \\\r\n          --accountemail \"hi@acme.sh\" \\\r\n          --accountkey ~\/myaccount.key \\\r\n          --accountconf ~\/myaccount.conf \\\r\n          --useragent \"this is my client.\"<\/code><\/pre>\n<p>You don&#8217;t need to set all options, just set those ones you care about.<\/p>\n<p>Options explained:<\/p>\n<ul>\n<li><code>--home<\/code>\u00a0is a customized directory to install\u00a0<code>acme.sh<\/code>\u00a0in. By default, it installs into\u00a0<code>~\/.acme.sh.<\/code><\/li>\n<li><code>--config-home<\/code>\u00a0is a writable folder, acme.sh will write all the files(including cert\/keys, configs) there. By default, it&#8217;s in\u00a0<code>--home.<\/code><\/li>\n<li><code>--cert-home<\/code>\u00a0is a customized dir to save the certs you issue. By default, it&#8217;s saved in\u00a0<code>--config-home<\/code>.<\/li>\n<li><code>--accountemail<\/code>\u00a0is the email used to register account to Let&#8217;s Encrypt, you will receive renewal notice email here. Default is empty.<\/li>\n<li><code>--accountkey<\/code>\u00a0is the file saving your account private key. By default it&#8217;s saved in\u00a0<code>--config-home<\/code>.<\/li>\n<li><code>--useragent<\/code>\u00a0is the user-agent header value used to send to Let&#8217;s Encrypt.<\/li>\n<\/ul>\n<p>After installation is complete, you can verify\u00a0it by checking\u00a0<code>acme.sh<\/code>\u00a0version:<\/p>\n<pre class=\"command\"><code>acme.sh --version\r\n# v2.8.1<\/code><\/pre>\n<p>The\u00a0program has a lot of commands and parameters that can be used. To get help you can run:<\/p>\n<pre class=\"command\"><code>acme.sh --help<\/code><\/pre>\n<h3 id=\"issue-an-ssl-cert\">Issue an SSL cert<\/h3>\n<p>If you already have a web server running, you should use\u00a0<em>webroot mode<\/em>. You\u00a0will need write access to the web root folder.\u00a0Here are some example commands that can be used to obtain cert via webroot mode:<\/p>\n<p>Single domain + Webroot mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com --webroot \/var\/www\/example.com\r\n<\/code><\/pre>\n<p>Multiple domains in the same cert\u00a0+ Webroot mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com -d www.example.com -d mail.example.com --webroot \/var\/www\/example.com<\/code><\/pre>\n<p>Single domain ECC\/ECDSA cert + Webroot mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com --webroot \/var\/www\/example.com --keylength ec-256<\/code><\/pre>\n<p>Multiple domains in the same ECC\/ECDSA cert\u00a0+ Webroot mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com -d www.example.com -d mail.example.com --webroot \/var\/www\/example.com --keylength ec-256<\/code><\/pre>\n<p>Valid values for\u00a0<code>--keylength<\/code>\u00a0are: 2048 (default), 3072, 4096, 8192 or ec-256, ec-384.<\/p>\n<p>If you don&#8217;t have a web server, maybe you are on a SMTP or FTP server, the 80 port is free, then you can use\u00a0<em>standalone mode.\u00a0<\/em>If you want to use this mode, you&#8217;ll need to install socat tools first.<\/p>\n<p>Single domain + Standalone mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com --standalone\r\n<\/code><\/pre>\n<p>Multiple domains in the same cert\u00a0+\u00a0Standalone mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com -d www.example.com -d mail.example.com --standalone\r\n<\/code><\/pre>\n<p>If you don&#8217;t have a web server, maybe you are on a\u00a0SMTP\u00a0or FTP server, the 443\u00a0port is free. You can use standalone\u00a0TLS\u00a0ALPN mode. Acme.sh has a builtin standalone\u00a0TLS\u00a0web server, it can listen at 443 port to issue the cert.<\/p>\n<p>Single domain + Standalone TLS ALPN mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com --alpn<\/code><\/pre>\n<p>Multiple domains in the same cert\u00a0+ Standalone TLS ALPN mode:<\/p>\n<pre class=\"command\"><code>acme.sh --issue -d example.com -d www.example.com --alpn<\/code><\/pre>\n<h3 id=\"automatic-dns-api-integration\">Automatic DNS API integration<\/h3>\n<p>If your DNS provider has an API, acme.sh\u00a0can use the\u00a0API\u00a0to automatically add the\u00a0DNS TXT\u00a0record for you. Your cert will be automatically issued and renewed. No\u00a0manually work is required.\u00a0Before requesting the certs configure your API keys and Email. Currently acme.sh\u00a0has automatic DNS integration with\u00a0around 60 DNS providers natively and can utilize Lexicon tool for those that are not supported natively.<\/p>\n<p>Single domain + CloudFlare DNS API mode:<\/p>\n<pre class=\"command\"><code>export CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"\r\nexport CF_Email=\"xxxx@sss.com\"\r\nacme.sh --issue -d example.com --dns dns_cf\r\n<\/code><\/pre>\n<p>Wildcard\u00a0cert\u00a0+ CloudFlare DNS API mode:<\/p>\n<pre class=\"command\"><code>export CF_Key=\"sdfsdfsdfljlbjkljlkjsdfoiwje\"\r\nexport CF_Email=\"xxxx@sss.com\"\r\nacme.sh --issue -d example.com -d '*.example.com' --dns dns_cf<\/code><\/pre>\n<p>If your\u00a0DNS provider doesn&#8217;t support any\u00a0API access, you can add the\u00a0TXT record manually.<\/p>\n<pre class=\"command\"><code>acme.sh --issue --dns -d example.com -d www.example.com -d cp.example.com\r\n<\/code><\/pre>\n<p>You should get an output like below:<\/p>\n<pre>Add the following txt record:\r\nDomain:_acme-challenge.example.com\r\nTxt value:9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c\r\n\r\nAdd the following txt record:\r\nDomain:_acme-challenge.www.example.com\r\nTxt value:9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\n\r\nPlease add those txt records to the domains. Waiting <span class=\"pl-k\">for<\/span> the dns to take effect.<\/pre>\n<p>Then just rerun with\u00a0<code>renew<\/code>\u00a0argument:<\/p>\n<pre class=\"command\"><code>acme.sh --renew -d example.com<\/code><\/pre>\n<p>Keep in mind that this is DNS manual mode and you can&#8217;t auto renew your certs. You will have to add a new\u00a0TXT record to your domain by your hand when\u00a0it&#8217;s time to renew certs. So\u00a0use\u00a0DNS\u00a0API mode instead, because it can be automated.<\/p>\n<h3 id=\"install-lets-encrypt-ssl-cert\">Install Let&#8217;s encrypt SSL cert<\/h3>\n<p>After cert(s) are generated, you probably want to install\/copy\u00a0issued certificate(s) to the correct location on the disk. You\u00a0must\u00a0use this command to copy the certs to the target files,\u00a0don&#8217;t\u00a0use the certs files in\u00a0<code>~\/.acme.sh\/<\/code>\u00a0folder, they are for internal use only, the folder structure may change in the future. Before installation,\u00a0create a sensible directory to store your certificates. That can be\u00a0<code>\/etc\/letsencrypt<\/code>,\u00a0<code>\/etc\/nginx\/ssl\u00a0<\/code>or\u00a0<code>\/etc\/apache2\/ssl<\/code>\u00a0for example, depending on your web server software and your own preferences to store SSL related stuff.<\/p>\n<p><strong>Apache<\/strong>\u00a0example:<\/p>\n<pre class=\"command\"><code>acme.sh --install-cert \\\r\n        --domain example.com \\ \r\n        --cert-file \/path\/to\/cert\/cert.pem \\\r\n        --key-file \/path\/to\/keyfile\/key.pem \\\r\n        --fullchain-file \/path\/to\/fullchain\/fullchain.pem \\\r\n        --reloadcmd \"sudo systemctl reload apache2.service\"<\/code><\/pre>\n<p><strong>Nginx<\/strong>\u00a0example:<\/p>\n<pre class=\"command\"><code>acme.sh --install-cert \\\r\n        --domain example.com \\ \r\n        --cert-file \/path\/to\/cert\/cert.pem \\\r\n        --key-file \/path\/to\/keyfile\/key.pem \\\r\n        --fullchain-file \/path\/to\/fullchain\/fullchain.pem \\\r\n        --reloadcmd \"sudo systemctl reload nginx.service\"<\/code><\/pre>\n<p>The parameters are stored in the .acme.sh configuration file, so you need to get it right for your system as this file is read when the cron job runs renewal. &#8220;reloadcmd&#8221; is dependent on your operating system and init system.<\/p>\n<h3 id=\"renew-the-lets-encrypt-ssl-certs\">Renew the Let&#8217;s Encrypt SSL certs<\/h3>\n<p>You don&#8217;t need to renew the certs manually. All the certs will be renewed automatically every\u00a0<strong>60<\/strong>\u00a0days.<\/p>\n<p>However, you can also force to renew a cert:<\/p>\n<div>\n<pre class=\"command\"><code>acme.sh --renew -d example.com --force<\/code><\/pre>\n<\/div>\n<p>or, for ECC cert:<\/p>\n<pre class=\"command\"><code>acme.sh --renew -d example.com --force --ecc<\/code><\/pre>\n<h3 id=\"how-to-upgrade-acmesh\">How to upgrade acme.sh<\/h3>\n<p>You can update acme.sh to the latest code with:<\/p>\n<pre class=\"command\"><code>acme.sh --upgrade<\/code><\/pre>\n<p>You can also enable auto upgrade:<\/p>\n<pre class=\"command\"><code>acme.sh --upgrade --auto-upgrade<\/code><\/pre>\n<p>Then\u00a0acme.sh\u00a0will be kept up to date automatically.<\/p>\n<p>That&#8217;s it. If you get stuck on anything visit acme.sh wiki page at\u00a0<a href=\"https:\/\/github.com\/Neilpang\/acme.sh\/wiki\">https:\/\/github.com\/Neilpang\/acme.sh\/wiki<\/a>.<\/p>\n<h2 id=\"links\">Links<\/h2>\n<ul>\n<li><a href=\"https:\/\/github.com\/Neilpang\/acme.sh\">https:\/\/github.com\/Neilpang\/acme.sh<\/a><\/li>\n<li><a href=\"https:\/\/letsencrypt.org\/\">https:\/\/letsencrypt.org\/<\/a><\/li>\n<\/ul>\n<p><a href=\"http:\/\/www.linuxtoday.com\/security\/getting-started-with-acme.sh-lets-encrypt-ssl-client-190205080525.html\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Acme.sh\u00a0is a simple, powerful and easy to use\u00a0ACME\u00a0protocol client written purely in Shell (Unix shell) language, compatible with bash, dash, and sh shells. It helps\u00a0manage installation, renewal, revocation of SSL certificates.\u00a0It supports ACME version 1 and ACME version 2 protocols, as well as ACME v2 wildcard certificates. Being a zero dependencies ACME client makes it &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/02\/07\/getting-started-with-acme-sh-lets-encrypt-ssl-client\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Getting started with acme.sh Let&#8217;s Encrypt SSL client&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9279","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/9279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=9279"}],"version-history":[{"count":2,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/9279\/revisions"}],"predecessor-version":[{"id":9491,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/9279\/revisions\/9491"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=9279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=9279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=9279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}