id          = "acme-sh"
name        = "acme.sh"
homepage    = "https://github.com/acmesh-official/acme.sh"
description = "A pure Unix shell script ACME client for SSL / TLS certificate automation."
executables = ["acme.sh"]

[dotfiles]

# The official README says installation creates ~/.acme.sh and places all
# certificates there. That directory also contains account and DNS-provider
# material, so it is classified as a whole-file secret directory.
# https://github.com/acmesh-official/acme.sh#1%EF%B8%8F-how-to-install
paths  = []
secret = ["~/.acme.sh/"]

[commands]
format = 1
label = "Issue a certificate"
description = "Issue or renew an ACME certificate for one or more domains with webroot, standalone, Apache or DNS validation. Install-cert, deploy and account management are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = false, short_attached = false, short_bundles = false }

[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/acmesh-official/acme.sh/blob/master/acme.sh"
revision = "master 2026-10"
evidence = """
  --issue                  Issue a cert.
  -r, --renew              Renew a cert.
  -d, --domain <domain.tld>         Specifies a domain, used to issue, renew or revoke etc.
  -f, --force                       Force install, force cert renewal or override sudo restrictions.
  --staging, --test                 Use staging server, for testing.
  --debug [0|1|2|3]                 Output debug info.
  -w, --webroot <directory>         Specifies the web root folder for web root mode.
  --standalone                      Use standalone mode.
  --apache                          Use Apache mode.
  --dns [dns_hook]                  Use dns manual mode or dns api.
  -k, --keylength <bits>            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256 (default), ec-384, ec-521.
  --server <server_uri>             ACME Directory Resource URI.
  --cert-file <file>                Path to copy the cert file to after issue/renew.
  --key-file <file>                 Path to copy the key file to after issue/renew.
  --fullchain-file <file>           Path to copy the fullchain cert file to after issue/renew.
  --reloadcmd <command>             Command to execute after issue/renew to reload the server.
"""

[[commands.field]]
id = "issue"
label = "Issue certificate"
type = "boolean"
option = ["--issue"]
sources = ["help"]

[[commands.field]]
id = "renew"
label = "Renew certificate"
type = "boolean"
option = ["--renew"]
sources = ["help"]

[[commands.field]]
id = "domain"
label = "Domains"
description = "One entry per domain; the first is the primary name."
type = "string"
option = ["--domain", "-d"]
multiple = true
sources = ["help"]

[[commands.field]]
id = "webroot"
label = "Web root"
type = "path"
option = ["--webroot", "-w"]
path = { kind = "directory", role = "input" }
sources = ["help"]

[[commands.field]]
id = "standalone"
label = "Standalone mode"
type = "boolean"
option = ["--standalone"]
sources = ["help"]

[[commands.field]]
id = "apache"
label = "Apache mode"
type = "boolean"
option = ["--apache"]
sources = ["help"]

[[commands.field]]
id = "dns_hook"
label = "DNS API hook"
description = "For example dns_cf; use the DNS API for validation."
type = "string"
option = ["--dns"]
sources = ["help"]

[[commands.field]]
id = "keylength"
label = "Key length"
type = "string"
option = ["--keylength", "-k"]
suggestions = [{ value = "2048", label = "RSA 2048" }, { value = "4096", label = "RSA 4096" }, { value = "ec-256", label = "ECC P-256" }, { value = "ec-384", label = "ECC P-384" }]
sources = ["help"]

[[commands.field]]
id = "server"
label = "ACME server"
type = "string"
option = ["--server"]
suggestions = [{ value = "letsencrypt", label = "Let's Encrypt" }, { value = "zerossl", label = "ZeroSSL" }]
sources = ["help"]

[[commands.field]]
id = "staging"
label = "Use staging server"
type = "boolean"
option = ["--staging"]
sources = ["help"]

[[commands.field]]
id = "force"
label = "Force"
type = "boolean"
option = ["--force", "-f"]
effect = "overwrite"
sources = ["help"]

[[commands.field]]
id = "cert_file"
label = "Copy cert to"
type = "path"
option = ["--cert-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.field]]
id = "key_file"
label = "Copy key to"
type = "path"
option = ["--key-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.field]]
id = "fullchain_file"
label = "Copy fullchain to"
type = "path"
option = ["--fullchain-file"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.field]]
id = "reloadcmd"
label = "Reload command"
type = "string"
option = ["--reloadcmd"]
effect = "exec"
sources = ["help"]

[[commands.task]]
id = "issue_webroot"
label = "Issue with webroot"
fields = ["issue", "domain", "webroot", "keylength"]
required = ["issue", "domain", "webroot"]
set = { issue = [true] }

[[commands.task]]
id = "issue_dns"
label = "Issue with DNS API"
fields = ["issue", "domain", "dns_hook", "keylength"]
required = ["issue", "domain", "dns_hook"]
set = { issue = [true] }

[[commands.task]]
id = "renew_domain"
label = "Renew a domain"
fields = ["renew", "domain", "force"]
required = ["renew", "domain"]
set = { renew = [true] }

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["issue", "renew", "domain", "webroot", "standalone", "apache", "dns_hook", "keylength"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["server", "staging", "force", "cert_file", "key_file", "fullchain_file", "reloadcmd"]