Automatically Renew SSL Certificates with ACME Protocol
ACME integrations let you order and renew 90-day certificates automatically and free of charge, using any major ACME client:
acme.sh, Caddy, win-acme, and more.
It's free. No credit card required.
For most setups we recommend a standard ACME client like acme.sh (Linux/shell), win-acme (Windows/IIS), or Caddy (built-in ACME). All work out of the box with ZeroSSL - no specific tooling required.
- #1 ACME client acme.sh is owned by ZeroSSL
- Several other ACME clients & server managed & maintained by ZeroSSL
- Fully Automated Solutions
ZeroSSL has partnered with all major ACME client integrations in order to ensure the largest possible level of compatibility among ACME users. Creating and renewing 90-day SSL certificates using third-party ACME clients is as easy as it gets, and fully automated.
- Free Creation of 90-Day Certificates
- Supporting all major ACME clients
- Fully Automated
In an effort to ensure the widest possible SSL certificate coverage around the world, our team has decided to keep all ZeroSSL certificates created using the ACME protocol completely free of charge.
- No Rate Limits
- 90-Day Certificates
- Multi-Domain Certificates
- Wildcard Certificates
To get started automating SSL certificates using the ACME protocol, click the button on the right to take a quick look at the ZeroSSL ACME documentation page.
ZeroSSL ACME Clients
| Integration | Type | |||
|---|---|---|---|---|
Acme.sh
|
Bash shell script | Zero dependencies (pure shell), huge DNS provider support, most widely used ACME client | Live | Acme.sh |
dehydrated
|
Bash shell script | Lightweight, POSIX-compliant, hook-based (easy to plug into custom deploy scripts) | Live | dehydrated |
|
win-acme
|
Windows (.exe, C#/.NET) | Purpose-built for Windows/IIS, auto-binds certs to IIS sites, runs as scheduled task | Live | win-acme |
CertMagic
|
Go library (built into Caddy server) | Fully automatic HTTPS — Caddy uses it natively so certs are issued/renewed with no separate client process at all | Live | CertMagic |
|
acme-companion
|
Docker container (companion to nginx-proxy) | Automates cert issuance/renewal for containers behind nginx-proxy — zero manual config, just Docker labels/env vars | Live | acme-companion |
|
getssl
|
Bash shell script | Similar niche to dehydrated/acme.sh but simpler config file per domain | Live | getssl |
|
Acme PHP
|
PHP CLI application | For PHP-based server stacks, integrates well with Symfony/PHP deployment workflows | Outdated | Acme PHP |
|
ZeroSSL Bot
|
Python-based CLI | EAB/API integration built-in, simple setup with ZeroSSL specifically | Outdated | ZeroSSL Bot |
|
auto-ssl
|
Bash shell script | Common in Nginx/OpenResty setups, lightweight, auto-renewal via cron | Abandoned | auto-ssl |
ZeroSSL works with any ACME-compatible client. For most setups we recommend a well-maintained, actively developed option like Acme.sh, dehydrated, win-acme, or CertMagic, the ZeroSSL Bot is still supported but maybe no longer the recommended path for every client setup.
ZeroSSL Webserver
| Integration | Type | |||
|---|---|---|---|---|
|
Caddy Server
|
Web server (built-in ACME) | Automatic HTTPS out of the box via CertMagic — no separate client needed | Live | Caddy Server |
|
nginx-proxy
|
Docker reverse proxy | Auto-generates nginx configs for containers based on VIRTUAL_HOST env vars; pairs with acme-companion for TLS | Live | nginx-proxy |
Ponzu
|
Headless CMS (Go) | Built-in HTTPS support via autocert; content API + admin UI in one binary | Abandoned | Ponzu |
If your server or reverse proxy has ACME support built in, you can skip a separate client entirely — certificates are issued and renewed automatically as part of normal operation.
3rd Party ACME Clients & Server
| Integration | Type | |||
|---|---|---|---|---|
Certbot
|
The original/reference Let's Encrypt client — plugins for Apache, Nginx, standalone modes | The original/reference Let's Encrypt client — plugins for Apache, Nginx, standalone modes | Live | Certbot |
lego
|
Go library + CLI | Widely embedded as a library inside other tools (e.g. Traefik uses it internally) | Live | lego |
Certify the Web
|
Windows ACME client (GUI) | GUI-based cert management for Windows/IIS, popular alternative for non-CLI users | Live | Certify the Web |
Traefik
|
Go reverse proxy (built-in ACME) | Native automatic HTTPS like Caddy — no external client needed, popular in Docker/Kubernetes setups | Live | Traefik |
Beyond the options above, these widely-used clients and proxies are also fully compatible with ZeroSSL's ACME endpoint.
