acme.sh ACME Client

acme.sh is a free ACME client that issues and renews SSL/TLS certificates. It is written entirely as a Unix shell script, so it needs no Python, Go or other runtime and runs on almost any Linux, BSD or macOS system, including small routers and containers. It is one of the most widely used ACME clients on GitHub, with tens of thousands of stars, and it is licensed under the GPL-3.0.

The project is actively maintained. Release 2.11.7 came out in October 2026, and commits land regularly. It installs into your home directory and does not need root, which keeps it tidy on shared or locked-down servers.

ZeroSSL is the default certificate authority, and you can switch to Let's Encrypt or other ACME CAs with one option. Certificates default to ECC keys and are renewed automatically every 30 days by a cron job, which can be changed. After renewal acme.sh can reload Apache or Nginx, or run a deploy hook to copy certificates to a load balancer, panel or appliance.

Validation can use the webroot, a standalone server, Apache or Nginx modes, or DNS. The DNS API mode is the main reason many admins choose acme.sh. It supports most DNS providers, so it can create the TXT records itself and renew wildcard certificates with no manual steps. A manual DNS mode exists but cannot renew automatically.

There is no paid tier or vendor support. Help comes from the project wiki, which documents each DNS provider and deploy hook, and from GitHub issues. For anyone comfortable on the command line it is a light, dependable way to automate certificates.