id = "acme-sh"
name = "acme.sh"
homepage = "https://github.com/acmesh-official/acme.sh"
description = "A pure Unix shell script ACME client for SSL / TLS certificate automation."
executables = ["acme.sh"]
[dotfiles]
paths = []
secret = ["~/.acme.sh/"]
[commands]
format = 1
label = "Issue a certificate"
description = "Issue or renew an ACME certificate for one or more domains with webroot, standalone, Apache or DNS validation. Install-cert, deploy and account management are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }
[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/acmesh-official/acme.sh/blob/master/acme.sh"
revision = "master 2026-10"
evidence = """
--issue Issue a cert.
-r, --renew Renew a cert.
-d, --domain <domain.tld> Specifies a domain, used to issue, renew or revoke etc.
-f, --force Force install, force cert renewal or override sudo restrictions.
--staging, --test Use staging server, for testing.
--debug [0|1|2|3] Output debug info.
-w, --webroot <directory> Specifies the web root folder for web root mode.
--standalone Use standalone mode.
--apache Use Apache mode.
--dns [dns_hook] Use dns manual mode or dns api.
-k, --keylength <bits> Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256 (default), ec-384, ec-521.
--server <server_uri> ACME Directory Resource URI.
--cert-file <file> Path to copy the cert file to after issue/renew.
--key-file <file> Path to copy the key file to after issue/renew.
--fullchain-file <file> Path to copy the fullchain cert file to after issue/renew.
--reloadcmd <command> Command to execute after issue/renew to reload the server.
"""
[[commands.field]]
id = "issue"
label = "Issue certificate"
type = "boolean"
option = ["--issue"]
sources = ["help"]
[[commands.field]]
id = "renew"
label = "Renew certificate"
type = "boolean"
option = ["--renew"]
sources = ["help"]
[[commands.field]]
id = "domain"
label = "Domains"
description = "One entry per domain; the first is the primary name."
type = "string"
option = ["--domain", "-d"]
multiple = true
sources = ["help"]
[[commands.field]]
id = "webroot"
label = "Web root"
type = "path"
option = ["--webroot", "-w"]
path = { kind = "directory", role = "input" }
sources = ["help"]
[[commands.field]]
id = "standalone"
label = "Standalone mode"
type = "boolean"
option = ["--standalone"]
sources = ["help"]
[[commands.field]]
id = "apache"
label = "Apache mode"
type = "boolean"
option = ["--apache"]
sources = ["help"]
[[commands.field]]
id = "dns_hook"
label = "DNS API hook"
description = "For example dns_cf; use the DNS API for validation."
type = "string"
option = ["--dns"]
sources = ["help"]
[[commands.field]]
id = "keylength"
label = "Key length"
type = "string"
option = ["--keylength", "-k"]
suggestions = [{ value = "2048", label = "RSA 2048" }, { value = "4096", label = "RSA 4096" }, { value = "ec-256", label = "ECC P-256" }, { value = "ec-384", label = "ECC P-384" }]
sources = ["help"]
[[commands.field]]
id = "server"
label = "ACME server"
type = "string"
option = ["--server"]
suggestions = [{ value = "letsencrypt", label = "Let's Encrypt" }, { value = "zerossl", label = "ZeroSSL" }]
sources = ["help"]
[[commands.field]]
id = "staging"
label = "Use staging server"
type = "boolean"
option = ["--staging"]
sources = ["help"]
[[commands.field]]
id = "force"
label = "Force"
type = "boolean"
option = ["--force", "-f"]
effect = "overwrite"
sources = ["help"]
[[commands.field]]
id = "cert_file"
label = "Copy cert to"
type = "path"
option = ["--cert-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]
[[commands.field]]
id = "key_file"
label = "Copy key to"
type = "path"
option = ["--key-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]
[[commands.field]]
id = "fullchain_file"
label = "Copy fullchain to"
type = "path"
option = ["--fullchain-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]
[[commands.field]]
id = "reloadcmd"
label = "Reload command"
type = "string"
option = ["--reloadcmd"]
effect = "exec"
sources = ["help"]
[[commands.task]]
id = "issue_webroot"
label = "Issue with webroot"
fields = ["issue", "domain", "webroot", "keylength"]
required = ["issue", "domain", "webroot"]
set = { issue = [true] }
[[commands.task]]
id = "issue_dns"
label = "Issue with DNS API"
fields = ["issue", "domain", "dns_hook", "keylength"]
required = ["issue", "domain", "dns_hook"]
set = { issue = [true] }
[[commands.task]]
id = "renew_domain"
label = "Renew a domain"
fields = ["renew", "domain", "force"]
required = ["renew", "domain"]
set = { renew = [true] }
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["issue", "renew", "domain", "webroot", "standalone", "apache", "dns_hook", "keylength"]
[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["server", "staging", "force", "cert_file", "key_file", "fullchain_file", "reloadcmd"]
