Last Edit: 2024.02.17

Debian / Ubuntu


Setup for automated certificate deployment.


  • Logged in as administrative user.

Create System User

Add a new system user for the Acmesh application and map the home directory to /opt/acmesh.

sudo useradd --system --user-group --create-home --home /opt/acmesh --shell /bin/false acmesh

Execute commands as the user using su.

sudo su -s /bin/bash acmesh -c "COMMAND_TO_RUN"


As the acmesh user, download the installation script from the project domain.

wget -O /opt/acmesh/

Review the installation script and run it.

sh /opt/acmesh/ email=[email protected]

Verify a cron job was successfully created for

crontab -e

There should be an entry resembling the following at the end of the file.

0 2 * * * "/opt/acmesh/"/ --cron --home "/opt/acmesh/" > /dev/null


Configure from the directory it was installed to, /opt/acmesh/ in this guide.

Select Certificate Authority

Select a certificate authority for to use for generating certificates. Refer to the CA documentation for an updated list of supported certificate authorities.

This guide will assume Let’s Encrypt is being used.

/opt/acmesh/ --set-default-ca --server letsencrypt

Configure DNS Provider

Provide API credentials for your DNS provider. These will be used for DNS-based ACME validation when generating new certificates.

Start by modifying the permissions for the account.conf file so no other system users can view your API credentials.

chmod 640 /opt/acmesh/

Open the account.conf configuration file.

nano /opt/acmesh/

Enter the API information required by your specific provider. Refer to the DNS API documentation and find your provider in the list.

This guide will assume the Cloudflare API is being used. Generate a new Cloudflare API token from your profile, and note the Zone ID on the relevant domain overview page.


Deploy Certificate

With configured, a certificate can now be easily deployed.

Issue Certificate

Issue a new certificate for a domain of choice, or wildcard, with the following command. Consider using the --staging flag while testing to prevent being rate-limited by Let’s Encrypt. Replace the Cloudflare DNS definition --dns dns_cf with the flag for your specific DNS provider; this flag instructs to use the DNS challenge.

/opt/acmesh/ --issue -d -d --dns dns_cf

Install Certificate

Install the generated certificate files to the directory required by your application. The following demonstrates deploying the certificates to the Apache ssl directory.

Start by modifying the directory so the acmesh user can write files to it.

sudo chown -R acmesh:root /etc/apache2/ssl && \
sudo chmod -R go= /etc/apache2/ssl

Run the certificate installation tool, specifying the locations to install certificates.

/opt/acmesh/ --installcert -d \
--certpath /etc/apache2/ssl/example-cr.pem \
--keypath /etc/apache2/ssl/example-cr.key \
--capath  /etc/apache2/ssl/example-ca.pem

You may also add the --reloadcmd flag to issue a command after the certificates are installed, this would require the acmesh user to have the proper permissions to run the command. For example, to restart Apache after a new certificate has been installed, add the following flag.

--reloadcmd  "systemctl restart apache2"


1 2 3 4

  1. acmesh-official. “ Documentation.” 2024. ↩︎

  2. acmesh-official. “ GitHub.” 2024. ↩︎

  3. Cloudflare. “Cloudflare API Documentation.” 2024. ↩︎

  4. Let’s Encrypt. “Let’s Encrypt Documentation.” 2024. ↩︎