acme.sh 实现了 acme 协议，可以从 ZeroSSL，Let’s Encrypt 等 CA 生成免费的证书。全文记录了使用acme.sh生成证书的过程。

安装acme.sh

在有梯子的情况下，
curl https://get.acme.sh | sh -s email=my@example.com
或
wget -O - https://get.acme.sh | sh -s email=my@example.com
没有梯子，
curl https://gh-proxy.com/https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh | sh -s -- --install -m my@example.com
普通用户和 root 用户都可以安装使用，完成以下任务：

把 acme.sh 安装到 home 目录下:
~/.acme.sh/
并创建一个 shell 的 alias，例如 .bashrc，方便使用: alias acme.sh=~/.acme.sh/acme.sh
自动创建 cronjob，每天 0:00 点自动检测所有的证书，如果达到自动更新的天数阈值，则会自动更新证书。

验证安装

~/.acme.sh/acme.sh --version
如果能正常显示版本号，就说明安装成功。

一键生成cf托管域名的证书

#!/bin/bash

# 1. 安装 acme.sh（如果未安装）- 使用镜像加速
if [ ! -f ~/.acme.sh/acme.sh ]; then
  echo "正在安装 acme.sh ..."
  curl https://gh-proxy.com/https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh  | sh -s -- --install -m my@example.com
  # 使别名立即生效
  source ~/.bashrc
fi

# 2. 设置 Cloudflare API Token（请务必替换成自己的！）
export CF_Token="xxxxxxx"

# 3. 申请泛域名证书（使用 DNS 方式）
~/.acme.sh/acme.sh --issue --dns dns_cf -d example.com -d *.example.com

# 4. 安装证书到统一目录 /root/ssl
mkdir -p /root/ssl
~/.acme.sh/acme.sh --install-cert -d example.com \
  --key-file /root/ssl/_.example.com.key \
  --fullchain-file /root/ssl/_.example.com.crt
  --reloadcmd "/usr/local/nginx/sbin/nginx -s reload"
echo "✅ 完成！证书已保存在 /root/ssl/ 目录"

更改CA
默认CA使用ZeroSSL.com。
更改CA，步骤3处：
~/.acme.sh/acme.sh --issue --dns dns_cf -d example.com -d *.example.com --server letsencrypt
修改默认 CA:
~/.acme.sh/acme.sh --set-default-ca --server letsencrypt
DNS 验证方式
–dns 选项，指明这个域名该用哪个 DNS 服务商插件去验证。需要先设置好 Cloudflare的DNS修改权限token。

查看证书有效性

查看证书的详细内容（包括有效期、颁发者、主题等）
openssl x509 -in /root/ssl/_.example.com.crt -text -noout

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:20:51:31:1b:0f:cd:77:b8:1d:87:a3:ae:a4:14:fa
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: C = AT, O = ZeroSSL GmbH, CN = ZeroSSL ECC DV SSL CA 2
        Validity
            Not Before: Aug  4 00:00:00 2026 GMT
            Not After : Nov  2 23:59:59 2026 GMT
        Subject: CN = example.com
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:23:c2:47:ed:d1:74:7e:23:d4:7a:2c:c3:0b:29:
                    46:df:b6:d3:ce:7e:96:15:45:2b:08:21:0f:6d:7e:
                    5c:f2:d9:d7:63:7c:f1:76:dd:fd:71:cf:17:94:70:
                    a8:ba:11:e7:3c:99:71:eb:37:e5:6f:1b:95:da:59:
                    8a:63:30:4c:59
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                94:45:9F:DA:51:47:71:D5:73:AE:AC:1D:AB:08:72:12:6D:AD:7C:62
            X509v3 Subject Key Identifier: 
                47:40:FF:53:EA:3A:1E:D2:8B:23:47:35:8E:0B:09:DA:B9:46:F4:0A
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
            X509v3 Certificate Policies: 
                Policy: 2.23.140.1.2.1
            Authority Information Access: 
                CA Issuers - URI:http://crt.sectigo.com/ZeroSSLECCDVSSLCA2.crt
                OCSP - URI:http://ocsp.sectigo.com
            CT Precertificate SCTs: 
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : D7:6D:7D:10:D1:A7:F5:77:C2:C7:E9:5F:D7:00:BF:F9:
                                82:C9:33:5A:65:E1:D0:B3:01:73:17:C0:C8:C5:69:77
                    Timestamp : Aug  4 02:19:47.750 2026 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:2D:71:63:84:DF:80:8C:BD:A1:03:19:BF:
                                FA:08:57:7C:6C:21:E5:DD:D4:B2:5A:13:42:EE:33:FB:
                                D8:F7:36:5F:02:20:69:52:76:BD:51:A7:47:3D:44:7C:
                                0F:5A:93:97:A6:86:6D:8A:FA:66:D9:BA:BA:52:B3:E4:
                                A6:33:21:11:88:23
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : C8:A3:C4:7F:C7:B3:AD:B9:35:6B:01:3F:6A:7A:12:6D:
                                E3:3A:4E:43:A5:C6:46:F9:97:AD:39:75:99:1D:CF:9A
                    Timestamp : Aug  4 02:19:47.622 2026 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:44:02:20:10:B5:F0:A5:73:02:E1:F7:55:EB:A1:6E:
                                C7:5D:DD:C1:EF:0E:8C:46:51:B9:8F:69:7C:3D:7D:68:
                                B8:93:FF:DC:02:20:1F:43:B4:08:2A:9F:13:D7:E0:C0:
                                51:C5:E2:9B:F1:7D:DB:51:FA:59:0F:FB:DC:23:B2:74:
                                FD:70:64:24:0E:7D
            X509v3 Subject Alternative Name: 
                DNS:qs100371.top, DNS:*.qs100371.top
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:46:02:21:00:95:9c:4b:21:e2:b2:eb:6a:b4:12:b5:bb:73:
        99:3d:24:ff:53:be:85:f5:7e:4a:36:45:09:0e:8b:3a:ed:ba:
        d3:02:21:00:ad:69:f5:3f:4d:30:57:a0:af:07:8a:25:25:e1:
        52:6b:1d:c6:01:99:54:9e:0b:32:ea:53:d4:3c:cc:60:0e:ce

快速查看证书的有效期起止时间
openssl x509 -in /root/ssl/_.example.com.crt -dates -noout
输出:
1
2
notBefore=Aug 4 00:00:00 2026 GMT
notAfter=Nov 2 23:59:59 2026 GMT
使用 acme.sh 自带命令查看
acme.sh --list
输出会包含证书的域名、到期日期等信息，非常直观。
1
2
Main_Domain KeyLength SAN_Domains Profile CA Created Renew
example.com "ec-256" *.example.com ZeroSSL.com 2026-08-04T02:20:05Z 2026-10-20T02:20:06Z
用lucky可以方便的生成泛域名证书。acme.sh也能很方便的生成，caddy能自动生成证书，只是生成泛域名证书麻烦一点。