$ show acmesh-official/acme.sh
acme.sh is a pure shell (POSIX sh) ACME protocol client for automated TLS/SSL certificate lifecycle management. It supports multiple Certificate Authorities (Let's Encrypt, ZeroSSL, Google, SSL.com, Actalis) and provides a wide range of validation methods including HTTP-01 (webroot, standalone, Apache, Nginx), DNS-01 (via 150+ DNS provider APIs), and TLS-ALPN-01. The tool is designed for unattended cron-based renewal and includes deploy hooks for installing certificates into various services (web servers, routers, firewalls, etc.) and notification hooks for alerting on renewal outcomes. The architecture is a monolithic shell script (acme.sh) that sources plugin modules from dnsapi/, deploy/, and notify/ directories. Each plugin follows a consistent function naming convention (e.g., dns_<provider>_add/rm, <target>_deploy, <service>_send) and uses shared internal helpers for HTTP requests, credential persistence, and JSON/XML parsing. The project emphasizes cross-platform compatibility (Linux, macOS, BSDs, Solaris, Windows/Cygwin) and avoids external dependencies beyond curl/wget and openssl. Key features include ECDSA and RSA key support, wildcard certificates, OCSP Must-Staple, External Account Binding (EAB), ACME Renewal Information (ARI, RFC 9773), and automatic upgrade. The codebase is well-tested across 20+ operating systems via GitHub Actions CI, using both Pebble test servers and real CAs. While the monolithic core script is large (~4000 lines), the plugin architecture enables easy extension for new DNS providers, deployment targets, and notification channels.
The LLM identified 3 files worth highlighting for reuse:
A minimal, self-contained deploy hook that copies certificate files to a local directory and executes a reload command. It demonstrates the standard deploy hook pattern: loading configuration via _getdeployconf/_savedeployconf, performing the copy, and running a user-defined command. Could be extracted into a standalone script by replacing the config functions with environment variables or arguments.
A notification hook that sends emails via SMTP using either curl or Python. It supports STARTTLS, SSL, and OAuth2 (Yandex 360). The implementation is well-structured with separate functions for curl and Python backends, credential management, and error handling. The pattern of supporting multiple transport methods with fallback is reusable for other notification services.
A DNS-01 challenge provider for Cloudflare API. It implements zone discovery by iterating domain labels, uses REST API calls with proper authentication (API token or email+key), and handles pagination. The code demonstrates the standard DNS plugin pattern: credential loading, zone detection, TXT record add/remove, and error checking. While dependent on acme.sh helpers, the logic is clean and could serve as a template for other REST-based DNS providers.