acme.sh: Install and Auto-Renew with Cloudflare DNS

acme.sh is a pure-shell ACME client. Combined with the Cloudflare DNS API, it fully automates issuance and renewal, including wildcard certificates.

Install

curl https://get.acme.sh | sh -s email=you@example.com
source ~/.bashrc
acme.sh --version

Get a Cloudflare API token

Log in to Cloudflare → My Profile → API Tokens → Create Token
Use the “Edit zone DNS” template, set permission Zone:DNS:Edit, scoped to your domain
Note down CF_Token and CF_Zone_ID (the Zone ID is on the domain Overview page, right side)

Set environment variables

export CF_Token="your_token"
export CF_Zone_ID="your_zone_id"

Issue a certificate

Single domain:

acme.sh --issue --dns dns_cf -d blog.example.com

Wildcard (includes the root domain automatically):

acme.sh --issue --dns dns_cf -d '*.example.com' -d example.com

Wildcard certs can only be validated via DNS, not HTTP.

Install cert to a target directory

acme.sh --install-cert -d '*.example.com' \
  --key-file /etc/ssl/example.com/privkey.pem \
  --fullchain-file /etc/ssl/example.com/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

Verify auto-renewal

acme.sh --cron --home "$HOME/.acme.sh"
acme.sh --list

acme.sh installs a crontab entry that checks daily and renews 30 days before expiry.

Inspect / update

acme.sh --info -d '*.example.com'   # certificate info
acme.sh --upgrade                   # upgrade acme.sh
acme.sh --update-account            # update the registered email

Notes

--reloadcmd runs after each successful renewal to reload your web service
Create /etc/ssl/example.com/ in advance and set permissions
Multiple domains for one cert must be in the same command