ACME clients and automated renewal

Automated certificate issuance stopped depending on a manual paste-and-install process. The ACME protocol lets a client prove it controls a domain and then receive a certificate, and it is how Let's Encrypt issues short-lived certificates. The client you choose mostly decides how that proof is delivered, how the renewal step is scheduled, and how easy it is to install the result into a web server or DNS provider.

How ACME works

An ACME client asks a certificate authority (CA) for an order for a set of domains. To satisfy the order it passes a challenge proving ownership. http-01 places a token at a URL over the domain; dns-01 writes a TXT record so the challenge is resolved through DNS rather than HTTP. When the CA verifies the challenge it sends the certificate, and the client stores the key and certificate for the web server. Renewal re-runs the same flow near the certificate expiry.

The Certbot route

Certbot is the reference client and is packaged for most Linux distributions. It includes Apache and Nginx plugins that both adjust the site config to use the new certificate and can revert the change when requested:

sudo apt install certbot certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot creates a systemd timer or cron entry that runs certbot renew automatically. http-01 is the default path and works whenever the web server answers on port 80 for the domain. Choose Certbot when you manage a conventional Linux server, want the distribution package, or appreciate the built-in web server plugins.

The acme.sh route

acme.sh is a single POSIX shell script with a broad matrix of built-in DNS API hooks for over a hundred DNS providers. That matters for dns-01 deployment: instead of writing a TXT record by hand you configure the DNS provider's API token once, and the client creates and removes the record itself. It also installs to environments without Python:

curl https://get.acme.sh | sh -s [email protected]
~/.acme.sh/acme.sh --issue -d example.com --dns dns_cf

dns_cf here stands for the Cloudflare hook. acme.sh schedules renewal through cron. Choose it when you want dns-01 wildcard certificates, when you need a specific DNS provider hook, or when the target machine has no Python and you want no heavyweight runtime.

Which one fits

There is no universally better client, only a better fit. Certbot wins for a standard Linux web server with HTTP access and distribution package support. acme.sh wins for wildcard certificates, for DNS-API-driven automation, and for appliance or container runs where a static script is easier to bake in. Both keep the certificate and chain in the locations a server reads, and both handle renewal for you once scheduled.

Verify renewal

Whichever client you use, do a dry run after setup and confirm the certificates are actually being renewed, not merely installed today. Certbot exposes certbot renew --dry-run; acme.sh shows --renew. Treat the scheduled job as part of your operational baseline, because a certificate that expires because the timer was never created or a DNS API token rotated is still an outage.

Related acquisition

The ACME client answers the "how do I issue and renew" question against a CA's quotas. Read the rate-limits guide to understand how the 50-certificate-per-domain-per-week cap and the certificate-lifetime changes shape how auto-renewal clients should pace issuance.