Get Free SSL with acme.sh: Lightweight ACME Client for Linux VPS

If you are renting a Linux VPS and want to secure your website with HTTPS using free SSL certificates from Let's Encrypt, acme.sh is an excellent alternative to Certbot. This lightweight shell script streamlines certificate management and automates the renewal process without requiring Python dependencies. Whether you are running Nginx, Apache, or another web server, acme.sh provides a flexible and efficient solution for obtaining, installing, and renewing SSL certificates with minimal overhead.

Understanding acme.sh: A Pure Shell ACME Client

acme.sh is a pure-shell ACME (Automated Certificate Management Environment) client written entirely in bash. It communicates with Let's Encrypt or ZeroSSL to issue SSL/TLS certificates without any external dependencies like Python or other programming language runtimes. The entire acme.sh script is only about 100 KB in size, making it one of the smallest and most efficient ACME clients available. Despite its minimal footprint, acme.sh supports all standard certificate operations: issuance, installation, renewal, and revocation. The simplicity of acme.sh makes it particularly attractive to system administrators who prefer lightweight, self-contained tools that integrate seamlessly into their infrastructure.

acme.sh maintains an excellent community and is actively developed on GitHub. The project has been battle-tested in production environments across thousands of servers worldwide. Its popularity stems not just from size and simplicity, but also from its comprehensive feature set and extensive documentation. Many experienced DevOps professionals and system administrators prefer acme.sh for its predictability, transparency, and minimal resource usage compared to heavier alternatives.

Why Choose acme.sh Over Certbot?

While Certbot dominates the SSL certificate automation landscape, acme.sh offers several compelling advantages. First, acme.sh eliminates the need for Python installation and dependency management. Some minimalist VPS configurations intentionally exclude Python to reduce attack surface area and resource consumption. Certbot's Python dependency can be problematic on systems running different Python versions or where Python is unavailable. Second, acme.sh supports over 100 DNS provider plugins out of the box, including Cloudflare, DigitalOcean, AWS Route 53, Google Cloud DNS, and many others. This extensive DNS provider support dramatically simplifies wildcard certificate issuance without requiring port 80 or 443 to be open — especially valuable if your infrastructure sits behind a restrictive firewall or load balancer. Third, acme.sh's installation is non-intrusive. It does not modify system files or require system-level integration. acme.sh stores itself in the user's home directory and manages everything locally, giving you complete control and making uninstallation trivial if needed.

For VPS users who value simplicity and control, acme.sh is often the better choice. However, if you use shared hosting with DirectAdmin (like AsiaGB's plans starting at 500 baht/year), this discussion is moot — DirectAdmin includes Let's Encrypt with automatic renewal already configured. acme.sh addresses the needs of VPS customers who want to manage SSL certificates independently with full root access and zero hosting provider interference.

Installation Steps for acme.sh

Installing acme.sh requires SSH access to your VPS with root or sudo privileges. The installation is straightforward and automated. First, download and execute the installer script using curl: curl https://get.acme.sh | sh. The installer creates an ~/.acme.sh directory, copies the acme.sh script there, and automatically configures a daily cronjob for certificate renewal. Next, reload your shell environment to update PATH variables: source ~/.bashrc or simply log out and back in. Finally, verify the installation by checking the version: acme.sh --version. If the output shows the version number, installation succeeded. The entire process takes less than a minute and requires no additional configuration at this stage. acme.sh is now ready to issue your first certificate.

Issuing SSL Certificates Using Webroot Mode

Webroot mode is the simplest method for validating domain ownership and issuing standard (non-wildcard) certificates. Let's Encrypt places a validation token in your web root directory, then visits your domain via HTTP to verify you control it. This method requires that your domain resolves correctly and that port 80 is accessible. Before issuing a certificate, identify your web root path (typically /home/username/public_html, /var/www/html, or /home/username/www). Then execute: acme.sh --issue -d yourdomain.com -d www.yourdomain.com -w /home/username/public_html. acme.sh writes a validation file to the web root, Let's Encrypt retrieves and verifies it, and upon success, your certificate is issued and stored in ~/.acme.sh/yourdomain.com/. The certificate files (cert.pem and key.pem) are now ready for installation on your web server. Webroot mode is reliable, auditable, and works with any web server serving files from that directory.

Obtaining Wildcard Certificates with DNS API Mode

If you need a wildcard certificate covering *.yourdomain.com and all subdomains, DNS API mode is the solution. Instead of placing a file in your web root, acme.sh creates a DNS TXT record for domain validation. This approach works even if port 80 is blocked and supports unlimited subdomains under one certificate. To use DNS API mode, first obtain API credentials from your DNS provider. For Cloudflare, generate an API token from the dashboard. For DigitalOcean, get your API key from account settings. For other providers, acme.sh documentation lists the required credentials. Next, export the credentials as environment variables: export CF_Token="your_cloudflare_api_token". Finally, issue the wildcard certificate: acme.sh --issue -d yourdomain.com -d "*.yourdomain.com" --dns dns_cf. acme.sh queries the Let's Encrypt ACME server, receives a DNS challenge, automatically creates the TXT record in your DNS provider's infrastructure, waits for propagation, validates ownership, and issues the certificate. The entire process is automated and typically completes within a few minutes. Wildcard certificates are ideal for organizations managing multiple subdomains, eliminating the need to renew individual certificates for each subdomain separately.

Installing Certificates into Web Servers

After successfully issuing a certificate, installation into your web server is the next step. acme.sh simplifies this with the --installcert flag, which copies certificates to designated locations and automatically reloads your web server. For Nginx, the command is: acme.sh --installcert -d yourdomain.com --key-file /etc/nginx/ssl/yourdomain.com.key --fullchain-file /etc/nginx/ssl/yourdomain.com.crt --reloadcmd "systemctl reload nginx". For Apache, substitute Apache paths and the reload command: acme.sh --installcert -d yourdomain.com --key-file /etc/apache2/ssl/yourdomain.com.key --fullchain-file /etc/apache2/ssl/yourdomain.com.crt --reloadcmd "systemctl reload apache2". acme.sh copies files to the specified locations with appropriate permissions and automatically reloads the web server so it uses the new certificates immediately. Your web server's configuration file must already reference these certificate paths in its SSL directives. After installation, update your Nginx or Apache configuration to point to these certificate locations, then test the configuration before deploying. Running acme.sh with these flags is sufficient for most standard deployments.

Automating Certificate Renewal with Cron

One of acme.sh's standout features is automatic certificate renewal without any additional setup required from you. During installation, acme.sh registers a cronjob that runs daily at midnight UTC. This cronjob checks all certificates managed by acme.sh and automatically renews any certificate that expires within the next 30 days. Renewal happens silently in the background — you receive no notifications unless something fails. acme.sh intelligently handles renewal details: it validates domains using the same method (webroot or DNS API) as the original issuance, installs renewed certificates to the paths specified during the first install, and reloads your web server automatically. To view all managed certificates and their expiration dates, run: acme.sh --list. This displays a summary of all certificates, their issuance dates, and expiration dates. If you need to force renewal of a specific certificate immediately (useful after DNS provider changes), use: acme.sh --renew -d yourdomain.com --force. In practice, most users never need to manually renew certificates after the initial setup — acme.sh handles everything automatically with zero downtime.

Troubleshooting Common acme.sh Issues

Despite acme.sh's reliability, deployment sometimes encounters issues worth understanding. If issuance fails, verify that your domain resolves correctly: run curl www.yourdomain.com and curl yourdomain.com from your VPS; both should load successfully. Firewall configuration is another common culprit — webroot mode requires port 80 (HTTP) to be accessible from the internet; if testing with curl from within your VPS succeeds but issuance fails, your firewall likely blocks incoming connections on port 80. Switching to DNS API mode bypasses this limitation entirely. If using DNS API mode, verify API credentials are correct and the DNS provider is properly configured. Review acme.sh logs for detailed error messages: acme.sh --log displays the most recent operations and any errors encountered. Let's Encrypt also enforces rate limiting: you can issue a maximum of 50 certificates per domain per 7-day period. If you test issuance repeatedly during troubleshooting, you may hit this limit and receive "too many certificates already issued" errors. Using the --staging flag allows testing against Let's Encrypt's staging environment without rate limits: acme.sh --issue -d yourdomain.com --dns dns_cf --staging. Once testing succeeds, remove --staging to issue a production certificate.

acme.sh Use Cases and Ideal Scenarios

acme.sh shines in several specific scenarios. Linux VPS users who want autonomous certificate management without hosting provider dependencies benefit greatly from acme.sh's independence. Development teams deploying multiple microservices or APIs often need to manage many SSL certificates across different subdomains and APIs; acme.sh's wildcard support and scriptable interface streamline this workflow. Organizations standardizing on open-source tooling prefer acme.sh's transparency and community governance over proprietary solutions. System administrators managing thousands of servers appreciate acme.sh's minimal resource footprint and predictable operation. Finally, users of less common web servers or specialized deployments (embedded systems, containerized apps, edge computing platforms) find acme.sh's portability and lack of dependencies invaluable. If you rent an AsiaGB VPS starting at 500 baht/month for Linux servers, acme.sh is immediately accessible without installing additional software or dealing with control-panel limitations.

Limitations and Important Considerations

While acme.sh excels in many scenarios, understanding its limitations ensures appropriate use. acme.sh requires SSH access and root or sudo privileges — shared hosting environments with restricted access cannot use acme.sh. If your hosting provider uses DirectAdmin or similar control panels with built-in Let's Encrypt support, acme.sh adds complexity without benefit. Firewall and network configuration significantly impact acme.sh functionality — restrictive firewalls blocking port 80 necessitate DNS API mode, and DNS query filtering may require workarounds. Let's Encrypt rate limiting (50 certificates per domain per 7 days) affects users who test repeatedly; always use staging mode during testing. Finally, acme.sh's simplicity means you retain full responsibility for certificate management — no automatic rollback, backup, or recovery mechanisms exist if you accidentally delete certificate files or misconfigure renewals. For managed hosting environments valuing hand-off management, premium SSL services with white-glove support may be preferable despite higher costs. For technically inclined users and system administrators, however, acme.sh provides unmatched flexibility and control.