Configuring SSL Certificates with acme.sh on OpenWRT

264 字

1 分钟

Configuring SSL Certificates with acme.sh on OpenWRT

2025-02-03

openwrt

OpenWRT

/

SSL

/

HTTPS

/

acme.sh

中文版

Preface#

OpenWRT’s built-in luci-app-acme is very hard to use, and official documentation is hard to find (many luci plugins are like this mess, e.g. tinyproxy is also unmaintained…). So I chose the official original acmesh instead.

You can refer to the official README if needed

Installing acme.sh#

1
wget -O -  https://get.acme.sh | sh -s email=my@example.com
2
cd ~/.acme.sh
3
./acme.sh --upgrade --auto-upgrade

Configuring DNS API Keys#

Edit the ~/.acme.sh/account.conf file and add the following:

Since I use Cloudflare DNS, if you use something else, please refer to the official docs.

1
export CF_Zone_ID="aaaaaaaaaaa"
2
export CF_Token="aaaaaaaa"

Requesting a Certificate#

Use the following command to request a certificate via Cloudflare’s DNS validation method:

1
./acme.sh --issue --dns dns_cf -d admin.tski.uk -d '*.example.com' # The DNS method supports requesting wildcard certificates

Viewing the Certificate List#

You can view the requested certificates with the following command:

1
./acme.sh --list

Installing the Certificate#

Install the requested certificate to the target location and restart the uhttpd service:

1
./acme.sh --install-cert -d admin.tski.uk \
2
--key-file /etc/uhttpd.key \
3
--fullchain-file /etc/uhttpd.crt \
4
--reloadcmd '/etc/init.d/uhttpd restart'

Verifying the Installation Works#

Use the following command to force-renew the certificate:

1
./acme.sh --renew -d admin.tski.uk --force

If the installation succeeded, the output looks like this:

1
.......
2
[Mon Feb  3 16:14:16 CST 2025] Your cert is in: /root/.acme.sh/admin.tski.uk_ecc/admin.tski.uk.cer
3
[Mon Feb  3 16:14:16 CST 2025] Your cert key is in: /root/.acme.sh/admin.tski.uk_ecc/admin.tski.uk.key
4
[Mon Feb  3 16:14:16 CST 2025] The intermediate CA cert is in: /root/.acme.sh/admin.tski.uk_ecc/ca.cer
5
[Mon Feb  3 16:14:16 CST 2025] And the full-chain cert is in: /root/.acme.sh/admin.tski.uk_ecc/fullchain.cer
6
[Mon Feb  3 16:14:17 CST 2025] Installing key to: /etc/uhttpd.key
7
[Mon Feb  3 16:14:17 CST 2025] Installing full chain to: /etc/uhttpd.crt
8
[Mon Feb  3 16:14:17 CST 2025] Running reload cmd: /etc/init.d/uhttpd restart
9
[Mon Feb  3 16:14:17 CST 2025] Reload successful