How to Upgrade Your Site from HTTP to HTTPS with Free acme.sh Certificates

Many site owners now upgrade their sites from HTTP to HTTPS for security and to meet third‑party platform requirements such as Chrome’s “Not Secure” warning and WeChat Mini‑Program mandates.

http vs https

HTTPS adds the SSL/TLS protocol on top of HTTP, using a CA certificate to verify the server’s identity and encrypt traffic. Converting a site to HTTPS only requires adding a CA certificate.

Certificates can be obtained in two ways:

Purchase a commercial CA certificate from providers like Alibaba Cloud or Tencent Cloud.

Use a free certificate, e.g., from Let’s Encrypt.

Let’s Encrypt issues three‑month certificates that can be renewed automatically. The acme.sh script implements the ACME protocol and can continuously fetch and renew Let’s Encrypt certificates.

Install acme.sh

Installation is a single command: curl https://get.acme.sh | sh The script is installed to ~/.acme.sh/ and creates a convenient alias acme.sh=~/.acme.sh/acme.sh. It also sets up a daily cron job that checks for expiring certificates and renews them automatically, keeping all changes confined to the installation directory.

Generate Certificate

acme.sh

supports all ACME validation methods, typically HTTP‑01 or DNS‑01.

HTTP‑01 validation (place a file in the web root):

acme.sh --issue -d mydomain.com -d www.mydomain.com --webroot /home/wwwroot/mydomain.com/

For Apache, the script can read the configuration automatically: acme.sh --issue -d mydomain.com --apache For Nginx or reverse‑proxy setups: acme.sh --issue -d mydomain.com --nginx Standalone mode (no web server needed, listens on port 80): acme.sh --issue -d mydomain.com --standalone DNS‑01 validation (add a TXT record): acme.sh --issue --dns -d mydomain.com After the TXT record appears, add it via your DNS provider’s console, then run:

acme.sh --renew -d mydomain.com

acme.sh

integrates with many DNS providers (Cloudflare, DNSPod, GoDaddy, OVH, etc.) for automatic TXT record creation.

Install Certificate

Copy the generated certificate to the location required by your server using --installcert:

acme.sh --installcert -d <domain>.com \
  --key-file /etc/nginx/ssl/<domain>.key \
  --fullchain-file /etc/nginx/ssl/fullchain.cer \
  --reloadcmd "service nginx force-reload"

Note: Use /etc/nginx/ssl/fullchain.cer for ssl_certificate, not the domain‑specific .cer, to avoid chain‑incomplete errors in SSL Labs tests.

Update Certificate

Certificates are automatically renewed 60 days after issuance; no manual action is required.

Update acme.sh

Because the ACME protocol and Let’s Encrypt CA evolve frequently, keep acme.sh up to date: acme.sh --upgrade Enable automatic upgrades: acme.sh --upgrade --auto-upgrade Disable automatic upgrades:

acme.sh --upgrade --auto-upgrade 0

Troubleshooting

If errors occur, add the debug flag:

acme.sh --issue ... --debug

acme.sh --issue ... --debug 2

For more advanced usage, refer to the official wiki.