You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

376 lines
12 KiB

8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
8 years ago
9 years ago
9 years ago
8 years ago
9 years ago
8 years ago
8 years ago
8 years ago
9 years ago
9 years ago
8 years ago
8 years ago
9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
8 years ago
  1. # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
  2. - An ACME protocol client written purely in Shell (Unix shell) language.
  3. - Full ACME protocol implementation.
  4. - Simple, powerful and very easy to use. You only need 3 minutes to learn it.
  5. - Bash, dash and sh compatible.
  6. - Simplest shell script for Let's Encrypt free certificate client.
  7. - Purely written in Shell with no dependencies on python or the official Let's Encrypt client.
  8. - Just one script to issue, renew and install your certificates automatically.
  9. - DOES NOT require `root/sudoer` access.
  10. It's probably the `easiest&smallest&smartest` shell script to automatically issue & renew the free certificates from Let's Encrypt.
  11. Wiki: https://github.com/Neilpang/acme.sh/wiki
  12. # [中文说明](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
  13. # Tested OS
  14. | NO | Status| Platform|
  15. |----|-------|---------|
  16. |1|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/ubuntu-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Ubuntu
  17. |2|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/debian-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Debian
  18. |3|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/centos-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|CentOS
  19. |4|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/windows-cygwin.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
  20. |5|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/freebsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|FreeBSD
  21. |6|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/pfsense.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|pfsense
  22. |7|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/opensuse-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|openSUSE
  23. |8|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/alpine-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Alpine Linux (with curl)
  24. |9|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/base-archlinux.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Archlinux
  25. |10|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/fedora-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|fedora
  26. |11|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/kalilinux-kali-linux-docker.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Kali Linux
  27. |12|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/oraclelinux-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Oracle Linux
  28. |13|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/proxmox.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
  29. |14|-----| Cloud Linux https://github.com/Neilpang/le/issues/111
  30. |15|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/openbsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|OpenBSD
  31. |16|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/mageia.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Mageia
  32. |17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/Neilpang/acme.sh/wiki/How-to-run-on-OpenWRT)
  33. |18|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/solaris.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|SunOS/Solaris
  34. |19|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/gentoo-stage3-amd64.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Gentoo Linux
  35. For all build statuses, check our [daily build project](https://github.com/Neilpang/acmetest):
  36. https://github.com/Neilpang/acmetest
  37. # Supported modes
  38. - Webroot mode
  39. - Standalone mode
  40. - Apache mode
  41. - DNS mode
  42. # 1. How to install
  43. ### 1. Install online
  44. Check this project: https://github.com/Neilpang/get.acme.sh
  45. ```bash
  46. curl https://get.acme.sh | sh
  47. ```
  48. Or:
  49. ```bash
  50. wget -O - https://get.acme.sh | sh
  51. ```
  52. ### 2. Or, Install from git
  53. Clone this project and launch installation:
  54. ```bash
  55. git clone https://github.com/Neilpang/acme.sh.git
  56. cd ./acme.sh
  57. ./acme.sh --install
  58. ```
  59. You `don't have to be root` then, although `it is recommended`.
  60. Advanced Installation: https://github.com/Neilpang/acme.sh/wiki/How-to-install
  61. The installer will perform 3 actions:
  62. 1. Create and copy `acme.sh` to your home dir (`$HOME`): `~/.acme.sh/`.
  63. All certs will be placed in this folder too.
  64. 2. Create alias for: `acme.sh=~/.acme.sh/acme.sh`.
  65. 3. Create daily cron job to check and renew the certs if needed.
  66. Cron entry example:
  67. ```bash
  68. 0 0 * * * "/home/user/.acme.sh"/acme.sh --cron --home "/home/user/.acme.sh" > /dev/null
  69. ```
  70. After the installation, you must close the current terminal and reopen it to make the alias take effect.
  71. Ok, you are ready to issue certs now.
  72. Show help message:
  73. ```
  74. root@v1:~# acme.sh -h
  75. ```
  76. # 2. Just issue a cert
  77. **Example 1:** Single domain.
  78. ```bash
  79. acme.sh --issue -d example.com -w /home/wwwroot/example.com
  80. ```
  81. **Example 2:** Multiple domains in the same cert.
  82. ```bash
  83. acme.sh --issue -d example.com -d www.example.com -d cp.example.com -w /home/wwwroot/example.com
  84. ```
  85. The parameter `/home/wwwroot/example.com` is the web root folder. You **MUST** have `write access` to this folder.
  86. Second argument **"example.com"** is the main domain you want to issue the cert for.
  87. You must have at least one domain there.
  88. You must point and bind all the domains to the same webroot dir: `/home/wwwroot/example.com`.
  89. Generated/issued certs will be placed in `~/.acme.sh/example.com/`
  90. The issued cert will be renewed automatically every **60** days.
  91. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  92. # 3. Install the issued cert to Apache/Nginx etc.
  93. After you issue a cert, you probably want to install/copy the cert to your Apache/Nginx or other servers.
  94. You **MUST** use this command to copy the certs to the target files, **DO NOT** use the certs files in **~/.acme.sh/** folder, they are for internal use only, the folder structure may change in the future.
  95. **Apache** example:
  96. ```bash
  97. acme.sh --installcert -d example.com \
  98. --certpath /path/to/certfile/in/apache/cert.pem \
  99. --keypath /path/to/keyfile/in/apache/key.pem \
  100. --fullchainpath /path/to/fullchain/certfile/apache/fullchain.pem \
  101. --reloadcmd "service apache2 restart"
  102. ```
  103. **Nginx** example:
  104. ```bash
  105. acme.sh --installcert -d example.com \
  106. --keypath /path/to/keyfile/in/nginx/key.pem \
  107. --fullchainpath /path/to/fullchain/nginx/cert.pem \
  108. --reloadcmd "service nginx restart"
  109. ```
  110. Only the domain is required, all the other parameters are optional.
  111. Install/copy the issued cert/key to the production Apache or Nginx path.
  112. The cert will be `renewed every **60** days by default` (which is configurable). Once the cert is renewed, the Apache/Nginx service will be restarted automatically by the command: `service apache2 restart` or `service nginx restart`.
  113. # 4. Use Standalone server to issue cert
  114. **(requires you to be root/sudoer or have permission to listen on port 80 (TCP))**
  115. Port `80` (TCP) **MUST** be free to listen on, otherwise you will be prompted to free it and try again.
  116. ```bash
  117. acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
  118. ```
  119. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  120. # 5. Use Standalone TLS server to issue cert
  121. **(requires you to be root/sudoer or have permission to listen on port 443 (TCP))**
  122. acme.sh supports `tls-sni-01` validation.
  123. Port `443` (TCP) **MUST** be free to listen on, otherwise you will be prompted to free it and try again.
  124. ```bash
  125. acme.sh --issue --tls -d example.com -d www.example.com -d cp.example.com
  126. ```
  127. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  128. # 6. Use Apache mode
  129. **(requires you to be root/sudoer, since it is required to interact with Apache server)**
  130. If you are running a web server, Apache or Nginx, it is recommended to use the `Webroot mode`.
  131. Particularly, if you are running an Apache server, you should use Apache mode instead. This mode doesn't write any files to your web root folder.
  132. Just set string "apache" as the second argument and it will force use of apache plugin automatically.
  133. ```
  134. acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
  135. ```
  136. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  137. # 7. Use DNS mode:
  138. Support the `dns-01` challenge.
  139. ```bash
  140. acme.sh --issue --dns -d example.com -d www.example.com -d cp.example.com
  141. ```
  142. You should get an output like below:
  143. ```
  144. Add the following txt record:
  145. Domain:_acme-challenge.example.com
  146. Txt value:9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c
  147. Add the following txt record:
  148. Domain:_acme-challenge.www.example.com
  149. Txt value:9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  150. Please add those txt records to the domains. Waiting for the dns to take effect.
  151. ```
  152. Then just rerun with `renew` argument:
  153. ```bash
  154. acme.sh --renew -d example.com
  155. ```
  156. Ok, it's finished.
  157. # 8. Automatic DNS API integration
  158. If your DNS provider supports API access, we can use that API to automatically issue the certs.
  159. You don't have to do anything manually!
  160. ### Currently acme.sh supports:
  161. 1. CloudFlare.com API
  162. 1. DNSPod.cn API
  163. 1. CloudXNS.com API
  164. 1. GoDaddy.com API
  165. 1. OVH, kimsufi, soyoustart and runabove API
  166. 1. AWS Route 53, see: https://github.com/Neilpang/acme.sh/issues/65
  167. 1. PowerDNS.com API
  168. 1. lexicon DNS API: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
  169. (DigitalOcean, DNSimple, DNSMadeEasy, DNSPark, EasyDNS, Namesilo, NS1, PointHQ, Rage4 and Vultr etc.)
  170. 1. LuaDNS.com API
  171. 1. DNSMadeEasy.com API
  172. 1. nsupdate API
  173. **More APIs coming soon...**
  174. If your DNS provider is not on the supported list above, you can write your own DNS API script easily. If you do, please consider submitting a [Pull Request](https://github.com/Neilpang/acme.sh/pulls) and contribute it to the project.
  175. For more details: [How to use DNS API](dnsapi)
  176. # 9. Issue ECC certificates
  177. `Let's Encrypt` can now issue **ECDSA** certificates.
  178. And we support them too!
  179. Just set the `length` parameter with a prefix `ec-`.
  180. For example:
  181. ### Single domain ECC cerfiticate
  182. ```bash
  183. acme.sh --issue -w /home/wwwroot/example.com -d example.com --keylength ec-256
  184. ```
  185. ### SAN multi domain ECC certificate
  186. ```bash
  187. acme.sh --issue -w /home/wwwroot/example.com -d example.com -d www.example.com --keylength ec-256
  188. ```
  189. Please look at the last parameter above.
  190. Valid values are:
  191. 1. **ec-256 (prime256v1, "ECDSA P-256")**
  192. 2. **ec-384 (secp384r1, "ECDSA P-384")**
  193. 3. **ec-521 (secp521r1, "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
  194. # 10. How to renew the issued certs
  195. No, you don't need to renew the certs manually. All the certs will be renewed automatically every **60** days.
  196. However, you can also force to renew any cert:
  197. ```
  198. acme.sh --renew -d example.com --force
  199. ```
  200. or, for ECC cert:
  201. ```
  202. acme.sh --renew -d example.com --force --ecc
  203. ```
  204. # 11. How to upgrade `acme.sh`
  205. acme.sh is in constant developement, so it's strongly recommended to use the latest code.
  206. You can update acme.sh to the latest code:
  207. ```
  208. acme.sh --upgrade
  209. ```
  210. You can also enable auto upgrade:
  211. ```
  212. acme.sh --upgrade --auto-upgrade
  213. ```
  214. Then **acme.sh** will be kept up to date automatically.
  215. Disable auto upgrade:
  216. ```
  217. acme.sh --upgrade --auto-upgrade 0
  218. ```
  219. # 12. Issue a cert from an existing CSR
  220. https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
  221. # Under the Hood
  222. Speak ACME language using shell, directly to "Let's Encrypt".
  223. TODO:
  224. # Acknowledgments
  225. 1. Acme-tiny: https://github.com/diafygi/acme-tiny
  226. 2. ACME protocol: https://github.com/ietf-wg-acme/acme
  227. 3. Certbot: https://github.com/certbot/certbot
  228. # License & Others
  229. License is GPLv3
  230. Please Star and Fork me.
  231. [Issues](https://github.com/Neilpang/acme.sh/issues) and [pull requests](https://github.com/Neilpang/acme.sh/pulls) are welcome.
  232. # Donate
  233. 1. PayPal: donate@acme.sh
  234. [Donate List](https://github.com/Neilpang/acme.sh/wiki/Donate-list)