Want your own server to handle SSL certificates automatically, without you having to think about it? You can, with acme.sh. And here's the good news: bHosted is supported out of the box. Through our DNS API, acme.sh issues and renews your certificates fully automatically, including wildcard certificates. In this blog you'll learn what acme.sh is, how the bHosted integration works and how to set it up in a few steps.
What is acme.sh?
acme.sh is a free ACME client written entirely in shell script. With it you automatically request an SSL certificate from a certificate authority (CA) and install it on your server. A few things make acme.sh special:
- No extra software needed. It's pure shell script. No Python, no heavy dependencies.
- No root privileges required. You simply run it as a normal user.
- Wildcard and SAN certificates. One certificate for
*.yourdomain.comor several domains at once. - Automatic renewal. acme.sh sets up a cron job and renews your certificate in time. You never have to think about it again.
acme.sh works with every CA that supports the ACME protocol (RFC 8555). Think of Let's Encrypt, ZeroSSL (the default), Google Public CA and SSL.com. That gives you a free, trusted SSL certificate for your website. You'll find the source code on acme.sh on GitHub.
What is the DNS-01 challenge?
Before a CA issues a certificate, you have to prove the domain is yours. That's called a challenge. With the DNS-01 challenge you do this through a DNS record. acme.sh temporarily places a TXT record (_acme-challenge.yourdomain.com) in your DNS. The CA checks that record and issues the certificate. After that, the record is removed again.
The big advantage: your server doesn't need to be publicly reachable on port 80 or 443. And it's the only way to get a wildcard certificate (*.yourdomain.com). The downside? Without automation you'd have to create and delete those TXT records by hand every time. And that's exactly what the bHosted integration solves.
bHosted supports acme.sh
Good news: acme.sh has an official bHosted plugin. It ships with acme.sh by default and is called dns_bhosted. You'll find the script on GitHub: dns_bhosted.sh.
With this plugin, acme.sh talks directly to the bHosted DNS API. It automatically creates the right TXT records during the challenge and cleans them up afterwards. You don't have to touch your DNS by hand.
Setting up acme.sh with bHosted
1. Install acme.sh
curl https://get.acme.sh | sh -s email=you@example.com
2. Set your bHosted credentials
You'll need your bHosted API username and API password (your webservices credentials). You pass the password as an MD5 hash, just like in the bHosted webservices example.
export BHOSTED_Username="your-api-username"
export BHOSTED_Password="your-api-password"
Optionally, adjust the TTL (default 300 seconds):
export BHOSTED_TTL=300
3. Request your certificate
For a single domain plus the wildcard:
acme.sh --issue --dns dns_bhosted -d example.com -d '*.example.com'
acme.sh places the TXT records through bHosted, waits for the check and fetches your certificate. Want Let's Encrypt as the CA instead of the default ZeroSSL?
acme.sh --set-default-ca --server letsencrypt
4. Install the certificate
acme.sh --install-cert -d example.com \
--key-file /path/to/key.pem \
--fullchain-file /path/to/fullchain.pem \
--reloadcmd "systemctl reload nginx"
From now on acme.sh renews your certificate automatically. The cron job checks daily and renews well in time.
Do I need this with bHosted hosting?
Usually not. Every hosting package from bHosted already includes a free SSL certificate. We handle that automatically, you don't have to do a thing. Want to know more about the options? Take a look at our SSL certificates.
acme.sh is mainly useful when you manage your own server or VPS and want to automate certificates there, while your DNS runs at bHosted. Want to manage your DNS records yourself? That's easy with the DNS editor.
Frequently asked questions
Is acme.sh free?
Yes. acme.sh is free and open source. The certificates you fetch with it from Let's Encrypt or ZeroSSL are free too.
Does acme.sh work with a wildcard certificate?
Yes. Through the DNS-01 challenge, and therefore through the bHosted DNS API, you request a wildcard certificate (*.yourdomain.com).
Does my DNS need to be at bHosted?
For the dns_bhosted plugin, yes. acme.sh manages the TXT records through the bHosted DNS API, so your domain has to use bHosted's nameservers. Is your domain still somewhere else? Transfer your domain name to bHosted easily.
How often does acme.sh renew my certificate?
Automatically. acme.sh checks daily via a cron job and renews well in time. You don't have to do anything.
Which certificate authorities are supported?
All ACME CAs, including Let's Encrypt, ZeroSSL (default), Google Public CA and SSL.com.
Get started
Want everything in one place: hosting, domain and DNS? Take a look at our web hosting or register your domain name right away. Let acme.sh do the rest. Just be hosted.
