You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

359 lines
12 KiB

9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
9 years ago
8 years ago
8 years ago
9 years ago
8 years ago
9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
9 years ago
9 years ago
8 years ago
8 years ago
9 years ago
8 years ago
9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
9 years ago
9 years ago
9 years ago
8 years ago
9 years ago
8 years ago
  1. # An ACME Shell script: acme.sh
  2. - An ACME protocol client written purely in Shell (Unix shell) language.
  3. - Fully ACME protocol implementation.
  4. - Simple, powerful and very easy to use. You only need 3 minutes to learn.
  5. - Bash, dash and sh compatible.
  6. - Simplest shell script for Let's Encrypt free certificate client.
  7. - Purely written in Shell with no dependencies on python or Let's Encrypt official client.
  8. - Just one script, to issue, renew and install your certificates automatically.
  9. - DOES NOT require `root/sudoer` access.
  10. It's probably the `easiest&smallest&smartest` shell script to automatically issue & renew the free certificates from Let's Encrypt.
  11. Wiki: https://github.com/Neilpang/acme.sh/wiki
  12. # [中文说明](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
  13. #Tested OS
  14. | NO | Status| Platform|
  15. |----|-------|---------|
  16. |1|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/ubuntu-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Ubuntu
  17. |2|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/debian-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Debian
  18. |3|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/centos-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|CentOS
  19. |4|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/windows-cygwin.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
  20. |5|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/freebsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|FreeBSD
  21. |6|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/pfsense.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|pfsense
  22. |7|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/opensuse-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|openSUSE
  23. |8|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/alpine-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Alpine Linux (with curl)
  24. |9|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/base-archlinux.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Archlinux
  25. |10|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/fedora-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|fedora
  26. |11|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/kalilinux-kali-linux-docker.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Kali Linux
  27. |12|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/oraclelinux-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Oracle Linux
  28. |13|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/proxmox.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
  29. |14|-----| Cloud Linux https://github.com/Neilpang/le/issues/111
  30. |15|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/openbsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|OpenBSD
  31. |16|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/mageia.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Mageia
  32. |17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/Neilpang/acme.sh/wiki/How-to-run-on-OpenWRT)
  33. |18|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/solaris.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|SunOS/Solaris
  34. |19|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/gentoo-stage3-amd64.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Gentoo Linux
  35. For all build statuses, check our [daily build project](https://github.com/Neilpang/acmetest):
  36. https://github.com/Neilpang/acmetest
  37. # Supported Mode
  38. 1. Webroot mode
  39. 2. Standalone mode
  40. 3. Apache mode
  41. 4. Dns mode
  42. # 1. How to install
  43. ### 1. Install online:
  44. Check this project: https://github.com/Neilpang/get.acme.sh
  45. ```bash
  46. curl https://get.acme.sh | sh
  47. ```
  48. Or:
  49. ```bash
  50. wget -O - https://get.acme.sh | sh
  51. ```
  52. ### 2. Or, Install from git:
  53. Clone this project:
  54. ```bash
  55. git clone https://github.com/Neilpang/acme.sh.git
  56. cd ./acme.sh
  57. ./acme.sh --install
  58. ```
  59. You `don't have to be root` then, although `it is recommended`.
  60. Advanced Installation: https://github.com/Neilpang/acme.sh/wiki/How-to-install
  61. The installer will perform 3 actions:
  62. 1. Create and copy `acme.sh` to your home dir (`$HOME`): `~/.acme.sh/`.
  63. All certs will be placed in this folder.
  64. 2. Create alias for: `acme.sh=~/.acme.sh/acme.sh`.
  65. 3. Create everyday cron job to check and renew the cert if needed.
  66. Cron entry example:
  67. ```bash
  68. 0 0 * * * "/home/user/.acme.sh"/acme.sh --cron --home "/home/user/.acme.sh" > /dev/null
  69. ```
  70. After the installation, you must close current terminal and reopen again to make the alias take effect.
  71. Ok, you are ready to issue cert now.
  72. Show help message:
  73. ```
  74. root@v1:~# acme.sh -h
  75. ```
  76. # 2. Just issue a cert:
  77. **Example 1:** Single domain.
  78. ```bash
  79. acme.sh --issue -d example.com -w /home/wwwroot/example.com
  80. ```
  81. **Example 2:** Multiple domains in the same cert.
  82. ```bash
  83. acme.sh --issue -d example.com -d www.example.com -d cp.example.com -w /home/wwwroot/example.com
  84. ```
  85. The parameter `/home/wwwroot/example.com` is the web root folder. You **MUST** have `write access` to this folder.
  86. Second argument **"example.com"** is the main domain you want to issue cert for.
  87. You must have at least a domain there.
  88. You must point and bind all the domains to the same webroot dir: `/home/wwwroot/example.com`.
  89. Generate/issued certs will be placed in `~/.acme.sh/example.com/`
  90. The issued cert will be renewed every **60** days automatically.
  91. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  92. # 3. Install the issued cert to apache/nginx etc.
  93. After you issue a cert, you probably want to install/copy the cert to your nginx/apache or other servers.
  94. You **MUST** use this command to copy the certs to the target files, **Do NOT** use the certs files in **.acme.sh/** folder, they are for internal use only, the folder structure may change in future.
  95. **nginx** example
  96. ```bash
  97. acme.sh --installcert -d example.com \
  98. --keypath /path/to/keyfile/in/nginx/key.pem \
  99. --fullchainpath path/to/fullchain/nginx/cert.pem \
  100. --reloadcmd "service nginx restart"
  101. ```
  102. **apache** example
  103. ```bash
  104. acme.sh --installcert -d example.com \
  105. --certpath /path/to/certfile/in/apache/cert.pem \
  106. --keypath /path/to/keyfile/in/apache/key.pem \
  107. --fullchainpath path/to/fullchain/certfile/apache/fullchain.pem \
  108. --reloadcmd "service apache2 restart"
  109. ```
  110. Only the domain is required, all the other parameters are optional.
  111. Install/copy the issued cert/key to the production apache or nginx path.
  112. The cert will be `renewed every **60** days by default` (which is configurable). Once the cert is renewed, the apache/nginx will be automatically reloaded by the command: `service apache2 reload` or `service nginx reload`.
  113. # 4. Use Standalone server to issue cert
  114. **(requires you be root/sudoer, or you have permission to listen tcp 80 port)**
  115. The tcp `80` port **MUST** be free to listen, otherwise you will be prompted to free the `80` port and try again.
  116. ```bash
  117. acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
  118. ```
  119. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  120. # 5. Use Standalone tls server to issue cert
  121. **(requires you be root/sudoer, or you have permission to listen tcp 443 port)**
  122. acme.sh supports `tls-sni-01` validation.
  123. The tcp `443` port **MUST** be free to listen, otherwise you will be prompted to free the `443` port and try again.
  124. ```bash
  125. acme.sh --issue --tls -d example.com -d www.example.com -d cp.example.com
  126. ```
  127. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  128. # 6. Use Apache mode
  129. **(requires you be root/sudoer, since it is required to interact with apache server)**
  130. If you are running a web server, apache or nginx, it is recommended to use the `Webroot mode`.
  131. Particularly, if you are running an apache server, you should use apache mode instead. This mode doesn't write any files to your web root folder.
  132. Just set string "apache" as the second argument, it will force use of apache plugin automatically.
  133. ```
  134. acme.sh --issue --apache -d example.com -d www.example.com -d user.example.com
  135. ```
  136. More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
  137. # 7. Use DNS mode:
  138. Support the `dns-01` challenge.
  139. ```bash
  140. acme.sh --issue --dns -d example.com -d www.example.com -d user.example.com
  141. ```
  142. You should get the output like below:
  143. ```
  144. Add the following txt record:
  145. Domain:_acme-challenge.example.com
  146. Txt value:9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c
  147. Add the following txt record:
  148. Domain:_acme-challenge.www.example.com
  149. Txt value:9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  150. Please add those txt records to the domains. Waiting for the dns to take effect.
  151. ```
  152. Then just rerun with `renew` argument:
  153. ```bash
  154. acme.sh --renew -d example.com
  155. ```
  156. Ok, it's finished.
  157. # 8. Automatic DNS API integration
  158. If your DNS provider supports API access, we can use API to automatically issue the certs.
  159. You don't have do anything manually!
  160. ### Currently acme.sh supports:
  161. 1. Cloudflare.com API
  162. 2. Dnspod.cn API
  163. 3. Cloudxns.com API
  164. 4. Godaddy.com API
  165. 5. OVH, kimsufi, soyoustart and runabove API
  166. 6. AWS Route 53, see: https://github.com/Neilpang/acme.sh/issues/65
  167. 7. PowerDNS API
  168. 8. lexicon dns api: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
  169. (DigitalOcean, DNSimple, DnsMadeEasy, DNSPark, EasyDNS, Namesilo, NS1, PointHQ, Rage4 and Vultr etc.)
  170. 9. LuaDNS.com API
  171. ##### More APIs are coming soon...
  172. If your DNS provider is not on the supported list above, you can write your own script API easily. If you do please consider submitting a [Pull Request](https://github.com/Neilpang/acme.sh/pulls) and contribute to the project.
  173. For more details: [How to use dns api](dnsapi)
  174. # 9. Issue ECC certificate:
  175. `Let's Encrypt` now can issue **ECDSA** certificates.
  176. And we also support it.
  177. Just set the `length` parameter with a prefix `ec-`.
  178. For example:
  179. ### Single domain ECC cerfiticate:
  180. ```bash
  181. acme.sh --issue -w /home/wwwroot/example.com -d example.com --keylength ec-256
  182. ```
  183. SAN multi domain ECC certificate:
  184. ```bash
  185. acme.sh --issue -w /home/wwwroot/example.com -d example.com -d www.example.com --keylength ec-256
  186. ```
  187. Please look at the last parameter above.
  188. Valid values are:
  189. 1. **ec-256 (prime256v1, "ECDSA P-256")**
  190. 2. **ec-384 (secp384r1, "ECDSA P-384")**
  191. 3. **ec-521 (secp521r1, "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
  192. # 10. How to renew the cert
  193. No, you don't need to renew the certs manually. All the certs will be renewed automatically every **60** days.
  194. However, you can also force to renew any cert:
  195. ```
  196. acme.sh --renew -d example.com --force
  197. ```
  198. or, for ECC cert:
  199. ```
  200. acme.sh --renew -d example.com --force --ecc
  201. ```
  202. # 11. How to upgrade `acme.sh`
  203. acme.sh is in developing, it's strongly recommended to use the latest code.
  204. You can update acme.sh to the latest code:
  205. ```
  206. acme.sh --upgrade
  207. ```
  208. You can enable auto upgrade:
  209. ```
  210. acme.sh --upgrade --auto-upgrade
  211. ```
  212. Then **acme.sh** will keep up to date automatically.
  213. Disable auto upgrade:
  214. ```
  215. acme.sh --upgrade --auto-upgrade 0
  216. ```
  217. # 12. Issue a cert from an existing CSR
  218. https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
  219. # Under the Hood
  220. Speak ACME language using shell, directly to "Let's Encrypt".
  221. TODO:
  222. # Acknowledgment
  223. 1. Acme-tiny: https://github.com/diafygi/acme-tiny
  224. 2. ACME protocol: https://github.com/ietf-wg-acme/acme
  225. 3. Certbot: https://github.com/certbot/certbot
  226. # License & Others
  227. License is GPLv3
  228. Please Star and Fork me.
  229. [Issues](https://github.com/Neilpang/acme.sh/issues) and [pull requests](https://github.com/Neilpang/acme.sh/pulls) are welcomed.
  230. # Donate
  231. 1. PayPal: donate@acme.sh
  232. [Donate List](https://github.com/Neilpang/acme.sh/wiki/Donate-list)