acme.sh

mirror of https://github.com/acmesh-official/acme.sh.git synced 2024-12-26 01:00:10 +08:00

Google just announced its free ACME server: https://cloud.google.com/blog/products/identity-security/automate-public-certificate-lifecycle-management-via--acme-client-api

It supports multiple domains and wildcard domains. The lifetime of the cert is 90 days, too.

Follow this guide to create your EAB key and EAB id:

https://cloud.google.com/public-certificate-authority/docs/quickstart

OK, Done. You can register an ACME and issue certs now:

acme.sh  --register-account  -m  myemail@example.com --server google \
    --eab-kid xxxxxxx \
    --eab-hmac-key xxxxxxx

acme.sh --issue  --server google \
   -d example.com  --dns dns_googledomains

Here is an example cert:

The full chain:

Human readable format:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            84:1e:20:6c:5e:7e:20:e9:0e:00:00:00:00:03:2f:86
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, O=Google Trust Services LLC, CN=GTS CA 1P5
        Validity
            Not Before: Mar 30 13:34:35 2022 GMT
            Not After : Jun 28 13:34:34 2022 GMT
        Subject: CN=gca.neilpang.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:be:88:1b:f5:36:40:1b:ec:1f:27:d5:40:fe:17:
                    1f:dc:d7:d6:fc:13:3c:6f:1f:a1:5d:f7:6a:06:d2:
                    c0:94:c8:71:35:1c:e1:23:e4:c1:8f:5c:b6:98:5b:
                    98:3e:ea:bb:0b:e7:26:25:59:a6:70:6f:b3:b8:c9:
                    1a:df:79:c4:5f:b4:45:0a:7d:80:31:ca:76:0e:1e:
                    e6:7e:bc:36:8d:fa:a1:ae:e0:6a:62:26:82:b7:be:
                    05:2c:7c:ff:fc:ef:96:35:8e:bc:2c:f7:58:80:4b:
                    8a:76:1d:56:d1:41:39:b6:07:27:ee:c2:14:1a:fd:
                    c2:95:05:46:bb:99:22:b7:b1:18:56:20:17:0f:d7:
                    b2:fa:42:26:2e:07:6a:15:e0:f5:9f:6b:fb:f4:5f:
                    a7:62:6b:bf:9c:02:7c:94:f5:c7:93:50:03:9a:30:
                    13:c4:fe:ed:35:69:90:5e:8a:47:ff:54:e1:59:e8:
                    8c:cd:bf:a7:09:bf:b2:e9:fb:3b:17:0f:3d:43:c1:
                    02:3f:74:3e:1d:b0:73:c9:68:77:c7:cc:e9:b5:96:
                    db:d5:b8:7a:4a:b2:7b:53:3d:dc:cb:3f:cc:e6:17:
                    27:f8:46:d7:e5:93:56:b2:83:67:62:ee:4e:f0:63:
                    f0:0b:93:1b:2e:72:84:81:54:32:8d:42:74:43:7e:
                    1b:25
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                4A:D3:CD:4A:42:6E:2F:DC:A7:76:CD:2B:B8:B5:71:CF:80:17:E2:74
            X509v3 Authority Key Identifier:
                keyid:D5:FC:9E:0D:DF:1E:CA:DD:08:97:97:6E:2B:C5:5F:C5:2B:F5:EC:B8

            Authority Information Access:
                OCSP - URI:http://ocsp.pki.goog/s/gts1p5/EvYdWBESZcY
                CA Issuers - URI:http://pki.goog/repo/certs/gts1p5.der

            X509v3 Subject Alternative Name:
                DNS:gca.neilpang.com, DNS:*.gca.neilpang.com
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1
                Policy: 1.3.6.1.4.1.11129.2.5.3

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://crls.pki.goog/gts1p5/htAIIEEtXcY.crl

            1.3.6.1.4.1.11129.2.4.2:
                ......v.A...."FJ...:.B.^N1.....K.h..b........?.#.....G0E.!..........v."u.{....y.6.).|O..&... Pq...........t4...K^&.....0..YV..w.)y...99!.Vs.c.w..W}.`
....<.W.....B~......2...!......L.Kh..<a.....g..q3...=.`p.;
    Signature Algorithm: sha256WithRSAEncryption
         81:38:b6:42:02:22:9b:35:b5:79:dc:63:09:c4:45:e7:19:0c:
         f7:b2:93:b0:5a:7a:24:b8:0f:68:1c:16:73:f9:cd:12:48:f6:
         ce:a1:a7:09:43:2e:e9:9c:01:c3:4c:17:80:d5:c5:3d:57:9b:
         f1:83:92:fb:f7:73:eb:40:81:c6:32:a0:a4:63:78:b6:5c:83:
         36:5b:d5:35:67:1b:fc:96:4f:74:3e:bd:cc:8d:bd:8c:bf:52:
         e6:50:b8:5d:35:f6:99:42:a0:2b:e8:e7:3c:95:d2:a7:80:ae:
         9b:37:5a:dc:89:39:0e:50:1a:e1:26:a7:c5:6b:de:74:1c:1b:
         43:09:a5:73:60:31:5d:70:13:d4:b4:4d:69:fb:00:9f:b1:d9:
         cb:2b:1b:c8:90:8d:1f:b4:9c:90:55:aa:75:42:b9:10:c0:ae:
         1d:aa:60:54:1d:fd:6e:73:16:3e:3a:9f:f1:1d:cf:1d:23:ad:
         cd:fc:46:20:68:af:1e:08:4f:43:df:9b:6d:e8:f9:7b:e4:74:
         a0:ea:74:3a:ae:ce:ae:c5:75:86:b9:c0:35:e5:c1:02:4e:b9:
         fe:01:44:f0:68:ed:ae:5f:e1:f2:69:45:c2:f7:41:20:f0:7b:
         04:92:1e:10:ca:41:71:47:ef:8c:90:60:a6:b0:d2:04:68:13:
         bd:48:12:69

Buy me a beer, Donate to acme.sh if it saves your time. Your donation makes acme.sh better: https://donate.acme.sh/

如果 acme.sh 帮你节省了时间,请考虑赏我一杯啤酒🍺, 捐助: https://donate.acme.sh/ 你的支持将会使得 acme.sh 越来越好. 感谢