Acme.shのソースを表示

{{Lowercase title}}
[[Category:ネットワーク]]
[[Category:暗号化]]
[[Category:コマンド]]
[[en:Acme.sh]]
[https://github.com/acmesh-official/acme.sh acme.sh]  [[シェル]]スクリプトだけで書かれた ACME クライアントです。ACME プロトコルを完全に実装しており、例えば IPv6 やワイルドカード証明書などをサポートしています。

== インストール ==

{{Pkg|acme.sh}} パッケージを[[インストール]]します。スタンドアロンモードを使用する場合は、{{Pkg|socat}} をインストールします。

== 使用方法 ==

The package does not provide man pages, but a [https://github.com/acmesh-official/acme.sh/wiki/ wiki] for usage. Executing {{ic|acme.sh --help}} outputs a long list of commands and parameters.

There are three basic steps involved:

# Requesting a certificate to be issued.
# Installing the issued certificate, to make it useful.
# Maintaining the certificate over time.

as covered with below examples.

=== Issuing a new cert ===

You can specify any domain with the {{ic|-d}} option.

{{Tip|You might want to [https://community.letsencrypt.org/t/the-acme-sh-will-change-default-ca-to-zerossl-on-august-1st-2021/144052 specify] LetsEncrypt as your default CA, as acme.sh uses ZeroSSL as its default CA effective from August 1st, 2021.}}

The {{ic|acme.sh}} script support different modes. Examples for modes and options to be specified are:

* Webroot mode:

:{{ic|$ acme.sh --issue -d example.com -d www.example.com -d cp.example.com -d '*.example.com' -w /home/wwwroot/example.com}}

* Standalone mode, by adding {{ic|--standalone}} if no web server is running (requires {{Pkg|socat}} installed):

:{{ic|$ acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com}}

* Nginx mode:

:{{ic|$ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com}}

* DNS mode (see [https://github.com/acmesh-official/acme.sh/wiki/dnsapi official wiki] for further information):

:{{ic|$ acme.sh --issue -d example.com -d '*.example.com' --dns dns_he}}

The project's wiki lists [https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert more examples].

=== Install the cert to Apache/Nginx etc ===

Nginx:

 $ acme.sh --install-cert -d example.com --key-file '/path/to/keyfile/in/nginx/example.key' --fullchain-file '/path/to/fullchain/nginx/example.cer' --reloadcmd "systemctl force-reload nginx"

Apache:

 $ acme.sh --install-cert -d example.com --cert-file '/path/to/certfile/in/apache/example.cer' --key-file '/path/to/keyfile/in/apache/example.key' --fullchain-file '/path/to/fullchain/certfile/apache/example.fullchain.cer' --reloadcmd "systemctl force-reload nginx apache2"

=== Maintaining a cert ===

The certs will be renewed every 60 days. To run {{ic|acme.sh}} regularly, a [https://github.com/acmesh-official/acme.sh/wiki/Using-systemd-units-instead-of-cron systemd timer] may be set up.

== 参照 ==

* [https://github.com/acmesh-official/acme.sh Project homepage] and [https://github.com/acmesh-official/acme.sh/wiki/ wiki] for its documentation.
* [https://github.com/diafygi/ acme-tiny] offers several related utilities, as well as additional general ACME documentation.
* [https://git.guilhem.org/lacme/about/ lacme] is a small ACME client written with process isolation and minimal privileges in mind.