HTTPS Automation and Full Certificate Lifecycle Management: ACME.sh, DNS-01 Wildcard Issuance, and Production Nginx TLS 1.3 Configuration

In modern web architecture, Transport Layer Security (TLS) is more than a compliance requirement: it is fundamental to website speed, SEO ranking, and data integrity. When a site is hosted on an overseas cloud server with premium routing, such as BandwagonHost's CN2 GIA series or DMIT Premium/Pro instances, the inherently high physical round-trip time (RTT) of international transmission makes TLS handshake optimization and highly available certificate rotation particularly important.

许多运维人员依然依赖 Certbot 结合 HTTP-01 验证机制维护 Certificate 。这种模式在单机、低配或 Networking 拓扑复杂的生产环境中暴露了诸多隐患：Python 与 Snap 运行时带来的冗余 Memory 开销、80 端口必须 public network 暴露的安全妥协、无法签发泛域名 Certificate 的灵活性缺失，以及因防火墙或 CDN 节点阻断导致的 Certificate 续签中断。

From a practical modern web-infrastructure perspective, this article systematically examines the pure-Shell automation tool acme.sh and DNS-01 Validationcertificate lifecycle solution, implementing a strong Nginx TLS 1.3 production configuration with Perfect Forward Secrecy (PFS), zero-downtime reloads, and an SSL Labs A+ rating.

One. Choosing Certificate Automation: Architectural Trade-Offs Between acme.sh and Certbot#

In cloud server operations, the choice of automation client directly affects resource utilization and system stability.

When running production workloads on lightweight instances, such as basic BandwagonHost plans or DMIT Starter/Pocket plans with typically around 1GB of memory, resources should be prioritized for Nginx, databases, and core applications. Certbot and its background Snap daemon can cause memory fluctuations when scheduled tasks run, potentially leading the kernel to kill critical processes through OOM (Out Of Memory).

acme.sh Its pure-Shell architecture fully decouples it from the application environment. Compact and naturally compatible with Linux scheduling through Cron / Systemd Timers, it is ideal for low-overhead, highly stable operations.

Two. Validation Mechanisms: Why Production Should Fully Adopt DNS-01#

The ACME (Automated Certificate Management Environment) protocol primarily provides two methods for validating domain control:

1. Limitations of HTTP-01 Validation#

• 端口强制绑定: The CA server must access the server's following path over external HTTP (port 80): /.well-known/acme-challenge/ path. If the production instance has a strict inbound security group, or port 80 is blocked by a reverse proxy, internal-network isolation, or an intermediate security gateway, validation will fail outright.
• Wildcard Domains Not Supported: HTTP-01 cannot issue *.example.com wildcard certificates. Each newly added subdomain requires another configuration change and separate certificate issuance, increasing operational complexity.
• 跨境 Networking 干扰风险: Let's Encrypt's validation clusters are distributed worldwide. If HTTP requests from overseas nodes encounter temporary routing instability or cross-border gateway resets, certificate rotation can fail.

2. Production Advantages of DNS-01 Validation#

• Fully Decouple Network Ingress: The CA does not directly access any port on the VPS. Validation depends only on TXT records on authoritative DNS servers (_acme-challenge.example.com）。
• Native Wildcard Support: A single certificate can cover the root domain example.com 与全量子域名 *.example.com, greatly simplifying deployment of subsystems and microservices architectures.
• Strong Security and Support for Private-Network Environments: Even if the cloud server is in a private VPC, has no elastic public IP, or accepts only allowlisted IPs, certificate issuance and renewal can run silently as long as it can send outbound HTTPS requests to the DNS API.

Three. Prerequisites: System Preparation and Secure Operations Guidelines#

在开始 Certificate 配置之前，需确保宿主机具备 Standard 的 Networking 、安全与时间同步基线。

1. Instance Access and Operations Security Baseline#

Providers Differ in Their Underlying Operations Logic:

• DMIT instance : system images disable remote root password login by default during initial provisioning and require SSH key authentication. To change the authentication method or manage keys, use the DMIT console's Access perform the operation in the panel. Note that after updating the public key, you must reboot the instance (Reboot) through the panel before the new configuration is written to metadata and takes effect. If a firewall misconfiguration blocks the SSH port, you can use the instance panel's Console for out-of-band recovery.
• BandwagonHost instance : its KiwiVM management console has a dedicated administration password independent of both the client area and the system root password. If the host network is misconfigured or ports are blocked, you can use KiwiVM's Interactive Console 进入终端进行离线排障。

2. Synchronize the System Time and Time Zone#

ACME signature tokens and TLS certificate chains are extremely sensitive to timestamps. If the host system clock drifts by more than a few minutes, ACME handshake signatures may become invalid or OCSP Stapling validation may fail.

Using Ubuntu / Debian as an example, configure system time synchronization:

# 安装 chrony 时间同步工具
apt update && apt install -y chrony

# 启动并启用开机自启
systemctl enable --now chronyd

# 验证时间同步状态
chronyc tracking

确保本地时钟偏差（System time offset）维持在毫秒级别。

3. Install Basic Networking and Cryptographic Tools#

Ensure that the system has the POSIX tools required to run acme.sh:

apt install -y curl socat openssl cron

Four. Deploy acme.sh and Automate Certificate Issuance with the Cloudflare DNS API#

Step 1: Install acme.sh#

Run the official installation script as root. Supply a valid email address to receive official Let's Encrypt alerts about major certificate issues, such as API failures or CA policy changes:

curl https://get.acme.sh | sh -s [email protected]

The script automatically performs the following actions:

1. Install the core script in /root/.acme.sh/；
2. In /root/.bashrc create an alias in acme.sh；
3. Automatically detects the system's Crontab and adds a daily scheduled task to check for updates.

Apply the Changes to the Current Shell Environment:

source ~/.bashrc

Step 2: Change the Default Certificate Authority (CA)#

acme.sh currently defaults to ZeroSSL as its upstream CA. For compatibility and issuance speed, explicitly switch to Let's Encrypt, or retain ZeroSSL if needed:

acme.sh --set-default-ca --server letsencrypt

Step 3: Configure a Cloudflare API Token (Principle of Least Privilege)#

Never use an overly permissive Global API Key. Create a dedicated API Token in the Cloudflare dashboard following the principle of least privilege:

1. 登录 Cloudflare，进入 My Profile -> API Tokens, click Create Token；
2. Select Create Custom Token；
3. Token name: Can be named acme-dns-operator；
4. Permissions：
   • Zone - DNS - Edit
   • Zone - Zone - Read
5. Zone Resources：
   • Include - Specific zone - Select your target domain;
6. Create and save the Token string.

Export temporary environment variables in the cloud server terminal. After the first successful issuance, acme.sh automatically saves the encrypted credentials in sanitized form to ~/.acme.sh/account.conf , and subsequent scheduled tasks will reuse it automatically, without needing to .bashrc hardcoded permanently in it):

export CF_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export CF_Account_ID="yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"

Step 4: Issue an ECC Wildcard Certificate#

推荐全面采用现代椭圆曲线密码学（ECC）的 P-256 algorithm, which significantly outperforms traditional RSA 2048/4096 in handshake efficiency, computing resource consumption, and transmission size.

Run the wildcard certificate issuance command:

acme.sh --issue --dns dns_cf \
  -d example.com \
  -d *.example.com \
  --keylength ec-256

技术解析：

• --dns dns_cf: invokes the Cloudflare DNS API engine to automatically add to the domain _acme-challenge TXT 记录，并在 CA 验证 Passed 后自动删除该临时记录。
• -d example.com -d *.example.com: include both the primary domain and its wildcard subdomain in the SAN (Subject Alternative Name) extension of a single certificate to avoid certificate mismatches when accessing the primary domain.
• --keylength ec-256: Enforces the ECC algorithm (ECDSA signatures).

Five. Production Certificate Deployment Standards and Seamless Reloading#

In automated operations,Never Point the Web Server's (Nginx) Configuration Directly to ~/.acme.sh/ the internal working directory. This directory is acme.sh's internal state storage. Its file layout may change with script updates, and default permissions restrict files to root, potentially causing permission problems or broken symbolic links.

The Standard Official Approach Is to Use acme.sh --install-cert command to deploy the certificate to the standard system directory and attach a service reload hook.

Step 1: Plan the Production Certificate Storage Directory#

# 创建符合 FHS 规范的 SSL 存储目录并加固权限
mkdir -p /etc/nginx/ssl/example.com
chmod 750 /etc/nginx/ssl/example.com

步骤 2：安装 Certificate 并注册 Reload Hook#

Run the following command to deploy the certificate:

acme.sh --install-cert -d example.com --ecc \
  --key-file       /etc/nginx/ssl/example.com/privkey.pem \
  --fullchain-file /etc/nginx/ssl/example.com/fullchain.pem \
  --reloadcmd     "systemctl reload nginx"

Important Parameter Notes：

• --ecc: specifies that the previously issued EC certificate should be processed.
• --fullchain-file: must point to the full-chain file containing both the server certificate and intermediate CA certificates. Do not use only the individual cert.pem, otherwise mobile devices or some older systems may report an “incomplete/untrusted certificate chain” error.
• --reloadcmd: A crucial automation hook. When acme.sh completes a renewal in the background, this command runs automatically. Here, you must use systemctl reload nginx rather than restart, using Nginx's graceful restart mechanism to load the new certificate without downtime or interrupting existing long-lived connections.

Step 3: Verify Scheduled Task Health#

View the system's scheduled task configuration:

crontab -l | grep acme.sh

You will see a scheduled task similar to the following:

42 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

acme.sh 会在每日凌晨自动轮询。对于 Validity 为 90 days的 Let's Encrypt Certificate ，它默认会在Day 60intervenes and automatically performs: API writes TXT -> validate and issue -> copy updates to the production directory -> run systemctl reload nginx. The entire process is fully automated and requires no manual intervention.

Six. Hands-On Production Nginx TLS 1.3 Security Configuration with Strong Encryption#

After obtaining a high-quality certificate, the web server's protocol-stack configuration determines resistance to attacks and connection latency over the public internet. The following setup combines HTTP/2, TLS 1.3 preference, forward secrecy, HSTS, and OCSP Stapling.

Create a site configuration file in Nginx, for example /etc/nginx/conf.d/example.com.conf：

# 1. HTTP 流量全量强制重定向至 HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com *.example.com;

    # 规范化 301 永久重定向
    return 301 https://$host$request_uri;
}

# 2. HTTPS 强加密生产服务配置
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com *.example.com;

    # 证书与私钥路径（指向 install-cert 发布的生产规范路径）
    ssl_certificate     /etc/nginx/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/example.com/privkey.pem;

    # ---------------- 协议与加密套件优化 ----------------
    # 彻底禁用已废弃的 SSLv2/v3、TLSv1.0 与 TLSv1.1，仅允许现代安全协议
    ssl_protocols TLSv1.2 TLSv1.3;

    # TLS 1.2 兼容套件推荐（优先具备完全前向安全性的 ECDHE 算法）
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    
    # 在 TLS 1.3 中该指令已被标准废止；保留 off 可让客户端与服务端协商最优硬件加速算法
    ssl_prefer_server_ciphers off;

    # ---------------- SSL 会话复用与握手优化 ----------------
    # 开启共享会话缓存，10MB 缓存空间约可承载 40000 个长连接握手状态
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    
    # 禁用无状态 Session Ticket（避免因未轮换密钥损害完全前向安全性）
    ssl_session_tickets off;

    # ---------------- OCSP Stapling (在线证书状态装订) ----------------
    # 由服务端预先拉取并缓存证书吊销状态，省去客户端向 CA 查询的往返 RTT
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/nginx/ssl/example.com/fullchain.pem;
    
    # 必须指定解析 CA OCSP 域名的上游公共 DNS 服务器及超时阈值
    resolver 1.1.1.1 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    # ---------------- 安全响应头加固 ----------------
    # HSTS: 强制客户端浏览器在未来 1 年内必须通过 HTTPS 建立连接
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    # 基础安全防护头
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    # ---------------- 业务路径 ----------------
    root /var/www/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }
}

Validate and Hot-Reload the Configuration#

After making changes, be sure to validate the configuration syntax before performing a graceful reload:

# 测试配置文件语法的正确性
nginx -t

# 确认语法通过（syntax is ok）后，热重载配置
systemctl reload nginx

After deploying the configuration, you can use the authoritative assessment service Qualys SSL Labs 对站点进行全方位安全体检，按照上述配置 Standard ，站点将直接取得最高评级 A+。

Seven. Operational Troubleshooting, Edge Cases, and Instance Lifecycle Interactions#

In real production operations, certificate renewal is rarely an isolated script action; it is closely linked to DNS propagation, network conditions, and the cloud server lifecycle.

1. 手动强制模拟续期测试#

After installing the system, you do not need to wait 60 days to verify that the scheduled task works. You can use --force parameter to validate the renewal process end to end:

acme.sh --renew -d example.com --ecc --force

Watch for These Key Stages in the Output Logs:

1. whether the Cloudflare API was successfully called to create the TXT record;
2. whether CA validation has passed;
3. whether the new certificate has been copied to /etc/nginx/ssl/example.com/；
4. whether the Nginx process successfully received the reload signal.

2. DNS 解析传播延迟引发的校验超时#

With DNS providers that propagate changes slowly, Let's Encrypt may fail to resolve a TXT record just written by acme.sh, causing validation errors.

• Troubleshooting Approach: Cloudflare API changes usually take effect within seconds. If network instability occurs, you can temporarily set a DNS propagation waiting period before issuance (in seconds):
  bashCopy Code

  export CF_DNS_SLEEP=120

  This environment variable forces acme.sh to wait 120 seconds after writing the record before notifying the CA to validate it, effectively avoiding international DNS propagation delays.

3. Cascading Effects of Server Lifecycle, Renewals, and Certificate Chains#

Server downtime or an abnormal billing status is a major blind spot that can cause automated certificate maintenance to fail:

• Billing and Nonpayment-Related Outage Risks：
  • BandwagonHost: Its billing system does not automatically debit a linked credit card or PayPal account without authentication. Under its renewal policy, invoices are generated 7 days before expiration when renewal is enabled, and available account credit can be used. If you do not top up or confirm balance payment in time, the instance stops at expiration, taking Nginx offline and blocking subsequent website access.
  • DMIT: monthly renewal invoices are also generated 7 days before the instance expires. If an invoice is not paid promptly, the server is generally retained for only 3 days after suspension at expiry; if payment remains overdue, its data will be permanently destroyed.
• The Silent Certificate Expiration Trap：虽然基于 DNS-01 的签发不依赖 VPS 80 端口，但The Host Running Scheduled Tasks Must Be Online and Operating. If an instance is temporarily shut down for an overdue invoice during acme.sh's 60~90-day renewal window, Cron cannot run. Even after topping up and restoring the instance, browsers may block the site because the certificate has fully expired. Set up regular availability monitoring for production instances and include certificate expiration as a separate externally monitored alert metric.

八、 总结与自动化运维清单#

By using the lightweight, pure-Shell tool acme.sh and DNS-01 Validationcombined, we have built a fault-tolerant, fully automated HTTPS lifecycle requiring no manual maintenance. Here is a recap of the implementation steps and operating guidelines:

1. 环境选型: on lightweight production VPS instances, avoid bulky Certbot and Snap dependencies and use the minimalist acme.sh；
2. Decouple Validation: Use finely scoped Cloudflare API Tokens and DNS-01 instead of HTTP-01 to issue wildcard certificates while supporting private-network topologies;
3. Architecture Standards：严格使用 --install-cert Manage production certificates centrally, never directly symlink the internal working directory, and use --reloadcmd achieve a seamless, disruption-free reload;
4. Strong Encryption Configuration: Uses ECC P-256 throughout, combined with TLS 1.3, forward-secure cipher suites, HSTS, and OCSP Stapling, delivering exceptional handshake performance and strong security over high-latency international links.