ACME.SH(1)

🎀 ACME.SH 🎀

okay bestie, sit down, hydrate, because this is acme.sh — User Commands, manual section 1, and she is an icon. 💅

---

✨ NAME ✨

acme.sh — literally just acme.sh. that's the name. that's the whole name. iconic behaviour, no notes. 👑

---

🌸 SYNOPSIS 🌸

acme.sh <command> ... [parameters ...]

---

💖 DESCRIPTION 💖

the source of truth lives at https://github.com/acmesh-official/acme.sh and this is version v3.1.4. ✨

🦋 Commands: 🦋

• -h, --help — show this help message.
• -v, --version — show version info.
• --install — install acme.sh onto your system.
• --uninstall — uninstall acme.sh, and uninstall the cron job too. bye bestie 🫶
• --upgrade — upgrade acme.sh to the latest code from https://github.com/acmesh-official/acme.sh.
• --issue — issue a cert.
• --deploy — deploy the cert to your server.
• -i, --install-cert — install the issued cert to Apache/nginx or literally any other server.
• -r, --renew — renew a cert.
• --renew-all — renew all the certs. all of them. yes really. 🔥
• --revoke — revoke a cert.
• --remove — remove the cert from the list of certs known to acme.sh.
• --list — list all the certs.
• --info — show the acme.sh configs, or the configs for a domain with the [-d domain] parameter.
• --to-pkcs12 — export the certificate and key to a pfx file.
• --to-pkcs8 — convert to pkcs8 format.
• --sign-csr — issue a cert from an existing csr.
• --show-csr — show the content of a csr.
• -ccr, --create-csr — create CSR, professional use.
• --create-domain-key — create an domain private key, professional use.
• --update-account — update account info.
• --update-account-key — rotate account key.
• --register-account — register account key.
• --deactivate-account — deactivate the account.
• --make-dns-persist-value — print the DNS TXT record(s) to enable persistent DNS validation (draft-ietf-acme-dns-persist-01). use with -d <domain>.
• --create-account-key — create an account private key, professional use.
• --install-cronjob — install the cron job to renew certs, you don't need to call this. the install command can automatically install the cron job.
• --uninstall-cronjob — uninstall the cron job. the uninstall command can do this automatically.
• --cron — run cron job to renew all the certs.
• --set-notify — set the cron notification hook, level or mode.
• --deactivate — deactivate the domain authz, professional use.
• --set-default-ca — used with --server, set the default CA to use. see: https://github.com/acmesh-official/acme.sh/wiki/Server
• --set-default-chain — set the default preferred chain for a CA. see: https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain

🌈 Parameters: 🌈

• -d, --domain <domain.tld> — specifies a domain, used to issue, renew or revoke etc.
• --challenge-alias <domain.tld> — the challenge domain alias for DNS alias mode. see: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode
• --domain-alias <domain.tld> — the domain alias for DNS alias mode. see: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode
• --preferred-chain <chain> — if the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. if there's no match, the default offered chain will be used. (default: empty) see: https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain
• --cert-profile, --certificate-profile <profile> — if the CA offers profiles, select the desired profile. see: https://github.com/acmesh-official/acme.sh/wiki/Profile-selection
• --valid-to <date-time> — request the NotAfter field of the cert. see: https://github.com/acmesh-official/acme.sh/wiki/Validity
• --valid-from <date-time> — request the NotBefore field of the cert. see: https://github.com/acmesh-official/acme.sh/wiki/Validity
• -f, --force — force install, force cert renewal or override sudo restrictions.
• --staging, --test — use staging server, for testing.
• --debug [0|1|2|3] — output debug info. defaults to 2 if the argument is omitted.
• --output-insecure — output all the sensitive messages. by default all the credentials/sensitive messages are hidden from the output/debug/log for security. 🙈
• -w, --webroot <directory> — specifies the web root folder for web root mode.
• --standalone — use standalone mode.
• --alpn — use standalone alpn mode.
• --stateless — use stateless mode. see: https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode
• --apache — use Apache mode.
• --dns [dns_hook] — use dns manual mode or dns api. defaults to manual mode when the argument is omitted. see: https://github.com/acmesh-official/acme.sh/wiki/dnsapi
• --dns-persist — use dns-persist-01 validation (draft-ietf-acme-dns-persist-01). requires the persistent _validation-persist TXT record to already exist. use --make-dns-persist-value to print the value to add.
• --dnssleep <seconds> — the time in seconds to wait for all the txt records to propagate in dns api mode. it's not necessary to use this by default, acme.sh polls dns status by DOH automatically. ✨
• -k, --keylength <bits> — specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256 (default), ec-384, ec-521.
• -ak, --accountkeylength <bits> — specifies the account key length: 2048, 3072, 4096, 8192 or ec-256 (default), ec-384, ec-521.
• --log [file] — specifies the log file. defaults to "~/.acme.sh/acme.sh.log" if the argument is omitted.
• --log-level <1|2> — specifies the log level, default is 2.
• --syslog <0|3|6|7> — syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
• --eab-kid <eab_key_id> — Key Identifier for External Account Binding.
• --eab-hmac-key <eab_hmac_key> — HMAC key for External Account Binding.
• --dns-persist-wildcard — used with --make-dns-persist-value. adds policy=wildcard to the generated TXT record so the issuer is also authorized for wildcards and subdomains (draft-ietf-acme-dns-persist-01).
• --dns-persist-ca-name <name> — used with --make-dns-persist-value. use the given CA identity domain (e.g. ssl.com) as the issuer-domain-name in the TXT record. if omitted, the identities are read from the ACME directory's caaIdentities field and one record is printed per identity.
• --dns-persist-days <N> — used with --make-dns-persist-value. add a persistUntil field to the TXT record so the record self-expires N days from now (the CA will refuse new validations against the record after that time). if omitted, the record has no expiry.

these parameters are to install the cert to nginx/Apache or any other server after issue/renew a cert:

• --cert-file <file> — path to copy the cert file to after issue/renew.
• --key-file <file> — path to copy the key file to after issue/renew.
• --ca-file <file> — path to copy the intermediate cert file to after issue/renew.
• --fullchain-file <file> — path to copy the fullchain cert file to after issue/renew.
• --reloadcmd <command> — command to execute after issue/renew to reload the server.
• --server <server_uri> — ACME Directory Resource URI. (default: https://acme.zerossl.com/v2/DV90) see: https://github.com/acmesh-official/acme.sh/wiki/Server
• --accountconf <file> — specifies a customized account config file.
• --home <directory> — specifies the home dir for acme.sh.
• --cert-home <directory> — specifies the home dir to save all the certs.
• --config-home <directory> — specifies the home dir to save all the configurations.
• --useragent <string> — specifies the user agent string. it will be saved for future use too.
• -m, --email <email> — specifies the account email, only valid for the --install and --update-account command. multiple emails can be given as a comma-separated list: a@example.com,b@example.com
• --accountkey <file> — specifies the account key path, only valid for the --install command.
• --days <ndays> — specifies the days to renew the cert when using the --issue command. the default value is 30 days. a negative value renews that many days before the cert expiry. negative values could be used to specify a number of days relative to the expiration date of the certificate.
• --httpport <port> — specifies the standalone listening port. only valid if the server is behind a reverse proxy or load balancer.
• --tlsport <port> — specifies the standalone tls listening port. only valid if the server is behind a reverse proxy or load balancer.
• --local-address <ip> — specifies the standalone/tls server listening address, in case you have multiple ip addresses.
• --listraw — only used for the --list command, list the certs in raw format.
• -se, --stop-renew-on-error — only valid for the --renew-all command. stop if one cert has error in renewal.
• --treat-skip-as-success — only valid for the --renew-all command. treat skipped certs as success, return 0 instead of 2.
• --insecure — do not check the server certificate, in some devices, the api server's certificate may not be trusted.
• --ca-bundle <file> — specifies the path to the CA certificate bundle to verify api server's certificate.
• --ca-path <directory> — specifies directory containing CA certificates in PEM format, used by wget or curl.
• --no-cron — only valid for the --install command, which means: do not install the default cron job. in this case, the certs will not be renewed automatically. 😭
• --no-profile — only valid for the --install command, which means: do not install aliases to user profile.
• --no-color — do not output color text.
• --force-color — force output of color text. useful for non-interactive use with the aha tool for HTML E-Mails.
• --ecc — specifies use of the ECC cert. only valid for --install-cert, --renew, --remove , --revoke, --deploy, --to-pkcs8, --to-pkcs12 and --create-csr.
• --csr <file> — specifies the input csr.
• --pre-hook <command> — command to be run before obtaining any certificates.
• --post-hook <command> — a command that gets run after we try to get or renew certs. It runs no matter what, bestie — success, failure, the whole vibe. 💅
• --renew-hook <command> — runs after each cert that renewed successfully. every single one. one at a time. slay. ✨
• --deploy-hook <hookname> — this is the hook file that deploys the cert. that's the whole job. 🎀
• --extended-key-usage <string> — you can hand-write the CSR extended key usage value yourself instead of letting it be chosen. the default is serverAuth,clientAuth. 🔥
• --ocsp, --ocsp-must-staple — generate the OCSP-Must-Staple extension. iconic behavior honestly. 👑
• --always-force-new-domain-key — generates a brand new domain key on renewal. and listen: if you don't pass this, the domain key is not changed by default. lowkey important. 💖
• --auto-upgrade [0|1] — only valid for the --upgrade command, and it says whether to upgrade automatically in the future. if you leave the argument out, it defaults to 1. 🦋
• --listen-v4 — forces the standalone/tls server to listen at ipv4.
• --listen-v6 — forces the standalone/tls server to listen at ipv6. pick your fighter fr fr. 🌈
• --request-v4 — forces client requests to use ipv4 to connect to the CA server.
• --request-v6 — forces client requests to use ipv6 to connect to the CA server. 😤
• --openssl-bin <file> — lets you point at a custom openssl bin location. main character openssl energy. 🌸
• --use-wget — forces it to use wget, for when you've got both curl and wget installed and you need wget specifically. 💜
• --yes-I-know-dns-manual-mode-enough-go-ahead-please — forces use of dns manual mode. yes the flag name is a whole mood, no you cannot shorten it. see: https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode 🫶
• -b, --branch <branch> — only valid for the --upgrade command; tells it the branch name to upgrade to. 🧚
• --notify-level <0|1|2|3> — sets the notification level. default value is 2. so here's the girl math:
  • 0: disabled, no notification will be sent. not a single one. 🙈
  • 1: send notifications only when there is an error. 😭
  • 2: send notifications when a cert is successfully renewed, or there is an error.
  • 3: send notifications when a cert is skipped, renewed, or error. like, everything. all of it. ⭐
• --notify-mode <0|1> — sets the notification mode. default value is 0.
  • 0: Bulk mode. send all the domain's notifications in one message (mail). one big text message basically. 💖
  • 1: Cert mode. send a message for every single cert.
• --notify-hook <hookname> — sets the notify hook. 💌
• --notify-source <server name> — sets the server name in the notification message.
• --revoke-reason <0-10> — the reason for revocation, and you use it alongside the --revoke command. see: https://github.com/acmesh-official/acme.sh/wiki/revokecert 💀
• --password <password> — adds a password to the exported pfx or pkcs8 file. use it with --to-pkcs12 or --to-pkcs8. keep that password safe bestie, i'm begging. 🔐

---

📖 SEE ALSO

The full documentation for acme.sh is maintained as a Texinfo manual. If the info and acme.sh programs are properly installed at your site, the command

info acme.sh

should give you access to the complete manual. go read it, it's giving ✨ educated ✨. 🦋

---

and that's the whole page, babe — you officially know acme.sh. this was from acme.sh 3.1.4+~cs0.0.20260716, dated July 2026, and it's the ACME.SH(1) manual page. go renew some certs, you absolute legend 💅👑🌸