Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
c0fbe823
Commit
c0fbe823
authored
Aug 19, 2020
by
Christopher Engelhard
Browse files
reformat usage message for consistency & clarity
parent
58923b28
Changes
1
Show whitespace changes
Inline
Side-by-side
acme.sh
View file @
c0fbe823
...
...
@@ -6402,8 +6402,8 @@ showhelp() {
version
echo
"Usage:
$PROJECT_ENTRY
command ...[parameters]....
Commands:
--help
, -h
Show this help message.
--version
, -v
Show version info.
-h,
--help Show this help message.
-v,
--version Show version info.
--install Install
$PROJECT_NAME
to your system.
--uninstall Uninstall
$PROJECT_NAME
, and uninstall the cron job.
--upgrade Upgrade
$PROJECT_NAME
to the latest code from
$PROJECT
.
...
...
@@ -6411,7 +6411,7 @@ Commands:
--signcsr Issue a cert from an existing csr.
--deploy Deploy the cert to your server.
--install-cert Install the issued cert to apache/nginx or any other server.
--renew
, -r
Renew a cert.
-r,
--renew Renew a cert.
--renew-all Renew all the certs.
--revoke Revoke a cert.
--remove Remove the cert from list of certs known to
$PROJECT_NAME
.
...
...
@@ -6427,117 +6427,104 @@ Commands:
--deactivate-account Deactivate the account.
--create-account-key Create an account private key, professional use.
--create-domain-key Create an domain private key, professional use.
--createCSR
, -ccsr
Create CSR
, professional use.
-ccsr,
--createCSR Create CSR, professional use.
--deactivate Deactivate the domain authz, professional use.
--set-notify Set the cron notification hook, level or mode.
--set-default-ca Used with '--server' , to set the default CA to use to use.
Parameters:
--domain
, -d
domain.tld Specifies a domain, used to issue, renew or revoke etc.
--challenge-alias domain.tld
The challenge domain alias for DNS alias mode.
-d,
--domain
<
domain.tld
>
Specifies a domain, used to issue, renew or revoke etc.
--challenge-alias
<
domain.tld
>
The challenge domain alias for DNS alias mode.
See:
$_DNS_ALIAS_WIKI
--domain-alias domain.tld The domain alias for DNS alias mode.
--domain-alias <domain.tld> The domain alias for DNS alias mode.
See:
$_DNS_ALIAS_WIKI
--preferred-chain CHAIN If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name.
--preferred-chain <chain> If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name.
If no match, the default offered chain will be used. (default: empty)
See:
$_PREFERRED_CHAIN_WIKI
--force, -f Used to force to install or force to renew a cert immediately.
--staging, --test Use staging server, just for test.
--debug Output debug info.
-f, --force Force install, force cert renewal or override sudo restrictions.
--staging, --test Use staging server, for testing.
--debug [0|1|2|3] Output debug info. Defaults to 1 if argument is omitted.
--output-insecure Output all the sensitive messages.
By default all the credentials/sensitive messages are hidden from the output/debug/log for security.
--webroot, -w /path/to/webroot Specifies the web root folder for web root mode.
-w, --webroot </path/to/webroot> Specifies the web root folder for web root mode.
--standalone Use standalone mode.
--alpn Use standalone alpn mode.
--stateless Use stateless mode.
See:
$_STATELESS_WIKI
--apache Use apache mode.
--dns [dns_hook] Use dns mode or dns api.
--dns [dns_hook] Use dns
manual
mode or dns api.
Defaults to manual mode when argument is omitted.
See:
$_DNS_API_WIKI
--dnssleep 300 The time in seconds to wait for all the txt records to propagate in dns api mode.
--dnssleep <seconds> The time in seconds to wait for all the txt records to propagate in dns api mode.
It's not necessary to use this by default,
$PROJECT_NAME
polls dns status by DOH automatically.
--keylength, -k [2048] Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
--accountkeylength, -ak [2048] Specifies the account key length: 2048, 3072, 4096
--log [/path/to/logfile] Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
--log-level 1|2 Specifies the log level, default is 1.
--syslog [0|3|6|7] Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
--eab-kid EAB_KID Key Identifier for External Account Binding.
--eab-hmac-key EAB_HMAC_KEY HMAC key for External Account Binding.
-k, --keylength <bits> Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
-ak, --accountkeylength <bits> Specifies the account key length: 2048, 3072, 4096
--log [/path/to/logfile] Specifies the log file. Defaults to
\"
$DEFAULT_LOG_FILE
\"
if argument is omitted.
--log-level <1|2> Specifies the log level, default is 1.
--syslog <0|3|6|7> Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
--eab-kid <eab_key_id> Key Identifier for External Account Binding.
--eab-hmac-key <eab_hmac_key> HMAC key for External Account Binding.
These parameters are to install the cert to nginx/apache or any other server after issue/renew a cert:
--cert-file
After issue/renew,
the cert
w
il
l be copied to this path
.
--key-file
After issue/renew,
the key
w
il
l be copied to this path
.
--ca-file
After issue/renew,
the intermediate cert
w
il
l be copied to this path
.
--fullchain-file
After issue/renew,
the fullchain cert
w
il
l be copied to this path
.
--cert-file
Path to copy
the cert
f
il
e to after issue/renew.
.
--key-file
Path to copy
the key
f
il
e to after issue/renew
.
--ca-file
Path to copy
the intermediate cert
f
il
e to after issue/renew
.
--fullchain-file
Path to copy
the fullchain cert
f
il
e to after issue/renew
.
--reloadcmd
\"service nginx reload\" A
fter issue/renew
, it's used
to reload the server.
--reloadcmd
<command> Command to execute a
fter issue/renew to reload the server.
--server
SERVER
ACME Directory Resource URI. (default: $DEFAULT_CA)
--server
<server_uri>
ACME Directory Resource URI. (default:
$DEFAULT_CA
)
See:
$_SERVER_WIKI
--accountconf
Specifies a customized account config file.
--home
Specifies the home dir for $PROJECT_NAME.
--cert-home
Specifies the home dir to save all the certs, only valid for '--install' command.
--config-home
Specifies the home dir to save all the configurations.
--useragent
Specifies the user agent string. it will be saved for future use too.
--accountemail
, -m
Specifies the account email, only valid for the '--install' and '--update-account' command.
--accountkey
Specifies the account key path, only valid for the '--install' command.
--days
Specifies the days to renew the cert when using '--issue' command. The default value is $DEFAULT_RENEW days.
--httpport
Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
--tlsport
Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
--local-address
Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
--accountconf
<file>
Specifies a customized account config file.
--home
<directory>
Specifies the home dir for
$PROJECT_NAME
.
--cert-home
<directory>
Specifies the home dir to save all the certs, only valid for '--install' command.
--config-home
<directory>
Specifies the home dir to save all the configurations.
--useragent
<string>
Specifies the user agent string. it will be saved for future use too.
-m,
--accountemail
<email>
Specifies the account email, only valid for the '--install' and '--update-account' command.
--accountkey
<file>
Specifies the account key path, only valid for the '--install' command.
--days
<ndays>
Specifies the days to renew the cert when using '--issue' command. The default value is
$DEFAULT_RENEW
days.
--httpport
<port>
Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
--tlsport
<port>
Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
--local-address
<ip>
Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
--listraw Only used for '--list' command, list the certs in raw format.
--stopRenewOnError
, -se
Only valid for '--renew-all' command. Stop if one cert has error in renewal.
-se,
--stopRenewOnError Only valid for '--renew-all' command. Stop if one cert has error in renewal.
--insecure Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
--ca-bundle
Specifies the path to the CA certificate bundle to verify api server's certificate.
--ca-path
Specifies directory containing CA certificates in PEM format, used by wget or curl.
--ca-bundle
<file>
Specifies the path to the CA certificate bundle to verify api server's certificate.
--ca-path
<directory>
Specifies directory containing CA certificates in PEM format, used by wget or curl.
--nocron Only valid for '--install' command, which means: do not install the default cron job.
In this case, the certs will not be renewed automatically.
--noprofile Only valid for '--install' command, which means: do not install aliases to user profile.
--no-color Do not output color text.
--force-color Force output of color text. Useful for non-interactive use with the aha tool for HTML E-Mails.
--ecc Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
--csr
Specifies the input csr.
--pre-hook
Command to be run before obtaining any certificates.
--post-hook
Command to be run after attempting to obtain/renew certificates.
No matter
the obtain/renew
is
succe
ss
or failed.
--renew-hook
Command to be run
once fo
r each successfully renewed certificate.
--deploy-hook
The hook file to deploy cert
--ocsp-must-staple
, --ocsp
Generate
ocsp m
ust
Staple extension.
--always-force-new-domain-key Generate new domain key
whe
n renewal. Otherwise, the domain key is not changed by default.
--auto-upgrade
[0|1] Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
--csr
<file>
Specifies the input csr.
--pre-hook
<command>
Command to be run before obtaining any certificates.
--post-hook
<command>
Command to be run after attempting to obtain/renew certificates.
Runs regardless of whe
the
r
obtain/renew succe
eded
or failed.
--renew-hook
<command>
Command to be run
afte
r each successfully renewed certificate.
--deploy-hook
<hookname>
The hook file to deploy cert
--ocsp,
--ocsp-must-staple
Generate
OCSP-M
ust
-
Staple extension.
--always-force-new-domain-key Generate new domain key
o
n renewal. Otherwise, the domain key is not changed by default.
--auto-upgrade [0|1]
Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
Defaults to 1 if argument is omitted.
--listen-v4 Force standalone/tls server to listen at ipv4.
--listen-v6 Force standalone/tls server to listen at ipv6.
--openssl-bin
Specifies a custom openssl bin location.
--openssl-bin
<file>
Specifies a custom openssl bin location.
--use-wget Force to use wget, if you have both curl and wget installed.
--yes-I-know-dns-manual-mode-enough-go-ahead-please Force
to
use dns manual mode.
--yes-I-know-dns-manual-mode-enough-go-ahead-please Force use
of
dns manual mode.
See:
$_DNS_MANUAL_WIKI
--branch, -b Only valid for '--upgrade' command, specifies the branch name to upgrade to.
--notify-level 0|1|2|3 Set the notification level: Default value is $NOTIFY_LEVEL_DEFAULT.
-b, --branch <branch> Only valid for '--upgrade' command, specifies the branch name to upgrade to.
--notify-level <0|1|2|3> Set the notification level: Default value is
$NOTIFY_LEVEL_DEFAULT
.
0: disabled, no notification will be sent.
1: send notifications only when there is an error.
2: send notifications when a cert is successfully renewed, or there is an error.
3: send notifications when a cert is skipped, renewed, or error.
--notify-mode 0|1 Set notification mode. Default value is $NOTIFY_MODE_DEFAULT.
--notify-mode <0|1> Set notification mode. Default value is
$NOTIFY_MODE_DEFAULT
.
0: Bulk mode. Send all the domain's notifications in one message(mail).
1: Cert mode. Send a message for every single cert.
--notify-hook [hookname] Set the notify hook
--revoke-reason [0-10] The reason for '--revoke' command.
--notify-hook <hookname> Set the notify hook
--revoke-reason <0-10> The reason for revocation, can be used in conjunction with the '--revoke' command.
See:
$_REVOKE_WIKI
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment