# Using acme.sh to Secure Your Server with Free SSL
This guide shows you how to issue and manage SSL certificates using acme.sh, a lightweight alternative to Certbot for working with Let's Encrypt.
If you're already using our Certbot with Nginx guide, this is an alternative method that avoids installing Python dependencies and uses pure bash.
Why Use acme.sh?
- No dependencies (pure bash)
- Lightweight and portable
- Supports DNS and webroot challenge methods
- No need for system packages like
certbotorpython3-certbot-nginx
Installation
Install acme.sh as root:
curl https://get.acme.sh | sh
source ~/.bashrc
Make sure the command is available in your shell:
alias acme.sh=~/.acme.sh/acme.sh
Issue a Certificate
Make sure you have an A Record pointing to the server before issuing the SSL.
Use the --issue command with your domain and the correct webroot path (same as Nginx’s root):
acme.sh --issue -d your.domain.com -w /var/www/html
This places challenge files in your webroot for HTTP verification.
Renew Certificates
acme.sh installs a cron job by default. To manually renew:
acme.sh --renew -d your.domain.com
Use --force if you want to renew immediately.
Install the Certificate
Install the certificate to Nginx’s paths and reload the web server:
acme.sh --install-cert -d your.domain.com
--key-file /etc/ssl/private/domain.key
--fullchain-file /etc/ssl/certs/domain.pem
--reloadcmd "systemctl reload nginx"
Make sure these paths match your Nginx SSL config.
Fix: Let's Encrypt OCSP Must-Staple Error
As of May 2025, Let's Encrypt no longer supports the Must-Staple flag. If you see this error:
Signing failed. Finalize code was not 200.
{
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "Error finalizing order :: OCSP must-staple extension is no longer available: see https://letsencrypt.org/2024/12/05/ending-ocsp",
"status": 403
}
To fix:
- Open your domain’s acme.sh config:
nano ~/.acme.sh/your.domain.com/your.domain.com.conf
2. Delete or set this line:
Le_OCSP_Staple='0'
3. Renew the certificate:
acme.sh --renew -d your.domain.com
4. Reload Nginx:
systemctl reload nginx
Alternative: Start Fresh
acme.sh --remove -d your.domain.com
acme.sh --issue -d your.domain.com -w /var/www/html
Then reinstall the certificate.
Disable Must-Staple for Good
To make sure it doesn’t happen again:
export ACME_OCSP_MUST_STAPLE=0
Summary
-
acme.shis a clean alternative to Certbot for issuing SSL certificates. - Works perfectly with Nginx and no Python packages required.
- Includes a fix for the OCSP Must-Staple error now deprecated by Let's Encrypt.