ACME SSL Installation Guides

How to Install an ACME SSL Certificate on Apache or NGINX (Certbot)

Step 1: Install Certbot

For Debian/Ubuntu Systems

1. Update your package list:

   sudo apt update

2. Install Certbot with the appropriate plugin for your web server:

   Apache:

   sudo apt install certbot python3-certbot-apache

   NGINX:

   sudo apt install certbot python3-certbot-nginx

For Red Hat / CentOS / Fedora Systems

Using dnf/yum:

1. Enable the EPEL repository:

   sudo dnf install epel-release

2. Install Certbot with the appropriate plugin for your web server:

   Apache:

   sudo dnf install certbot python3-certbot-apache

   NGINX:

   sudo dnf install certbot python3-certbot-nginx

Step 2: Obtain and Install Certificate

For Apache

sudo certbot --apache --non-interactive --agree-tos \
  --server <acme-directory> \
  --email <your-email> \
  --eab-kid <your-eab-kid> \
  --eab-hmac-key <your-hmac-key> \
  --domain <your-domain> \
  --cert-name <your-certificate-name>

For NGINX

sudo certbot --nginx --non-interactive --agree-tos \
  --server <acme-directory> \
  --email <your-email> \
  --eab-kid <your-eab-kid> \
  --eab-hmac-key <your-hmac-key> \
  --domain <your-domain> \
  --cert-name <your-certificate-name>

Step 3: Verification

After the command completes successfully, verify that your certificate is installed and working:

• Visit https://yourdomain.com and check for the padlock
• Check that the certificate details show the correct domain and expiration date
• Use our Free Online SSL Connection Checker: https://www.nethub.com.hk/ssl-certificates/ssl-connection-checker/

Automatic Re-issuance

Certbot automatically configures a cron job or systemd timer to reissue your certificate before it expires. No manual intervention or additional configuration is required.

How to Install an ACME SSL Certificate on Apache or NGINX (acme.sh)

Step 1: Install acme.sh

Install acme.sh from web:

sudo curl https://get.acme.sh

Step 2: Obtain Certificate

Register ACME Account

sudo acme.sh --register-account \
  --server <acme-directory> \
  --eab-kid <your-eab-kid> \
  --eab-hmac-key <your-hmac-key>

Command to Issue Certificate with Apache

sudo acme.sh --issue \
  --server <acme-directory> \
  --apache \
  -d <your-domain>

Command to Issue Certificate with NGINX

sudo acme.sh --issue \
  --server <acme-directory> \
  --nginx \
  -d <your-domain>

Step 3: Install Certificate

Apache Example

sudo acme.sh --install-cert -d example.com \
  --cert-file       /path/to/certfile/in/apache/cert.pem \
  --key-file        /path/to/keyfile/in/apache/key.pem \
  --fullchain-file  /path/to/fullchain/certfile/apache/fullchain.pem \
  --reloadcmd       "service apache2 force-reload"

Nginx Example

sudo acme.sh --install-cert -d example.com \
  --key-file        /path/to/keyfile/in/nginx/key.pem \
  --fullchain-file  /path/to/fullchain/nginx/cert.pem \
  --reloadcmd       "service nginx force-reload"

Step 4: Verification

After the command completes successfully, verify that your certificate is installed and working:

• Visit https://yourdomain.com and check for the padlock
• Check that the certificate details show the correct domain and expiration date
• Use our Free Online SSL Connection Checker: https://www.nethub.com.hk/ssl-certificates/ssl-connection-checker/

Automatic Re-issuance

acme.sh automatically configures a cron job or systemd timer to reissue your certificate before it expires. No manual intervention or additional configuration is required.

How to Install an ACME SSL Certificate on Windows IIS (Win-ACME)

Step 1: Install Win-ACME

1. Download the latest version of Win-ACME from the official website: https://www.win-acme.com/
2. Extract the zip file to the following folder: C:\Program Files\Win-ACME
3. Run the program by double-clicking wacs.exe to confirm it launches successfully.

Step 2: Obtain and Install Certificate

Open PowerShell and run:

C:\Program Files\Win-ACME\wacs.exe --source iis --host <yourdomain.com> --certificatestore My --installation iis --acl-fullcontrol IIS_IUSRS,SYSTEM,Administrators --eab-key-identifier <your-eab-kid> --eab-key <your-hmac-key> --eab-algorithm HS256 --baseuri <acme-directory> --accepttos

Step 3: Verification

After the command completes successfully, verify that your certificate is installed and working:

• Visit https://yourdomain.com and check for the padlock
• Use our Free Online SSL Certificate Checker: https://www.nethub.com.hk/ssl-certificates/ssl-certificate-checker/
• You can also verify the HTTPS binding in IIS Manager under Server Manager → Tools → IIS Manager → Sites → [Your Site] → Bindings

Automatic Re-issuance

Win-ACME automatically configures a scheduled task to reissue your certificate before it expires. No manual intervention or additional configuration is required.

To confirm the scheduled re-issuance, run:

C:\Program Files\Win-ACME\wacs.exe --list --baseuri <acme-directory>

Official Links & Documentation for ACME Clients

For the most up-to-date information, installation options, advanced usage, and troubleshooting, refer to the official project pages below.