Table of Contents
This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
Starting with recent CA developments, some Certificate Authorities (CAs) now support issuing certificates under different profiles.
These profiles may differ in terms of validation rules, supported features, or certificate lifetime.
For example, Let’s Encrypt provides multiple certificate profiles that define validity periods and capabilities.
Usage
You can select the certificate profile during issuance with the --cert-profile parameter:
acme.sh --issue -d example.com --cert-profile <profile-name>
Example (Let’s Encrypt)
acme.sh --issue --server letsencrypt -d example.com -w /home/username/public_html --cert-profile tlsserver
This will request a certificate using Let’s Encrypt’s tlsserver profile.
Important: Certificate Lifetime and --days
Some profiles may reduce the validity period of the certificate (e.g. 160 hours lifetimes instead of 90 days).
When using such profiles, you should also set the --days parameter to ensure that acme.sh renews the certificate early enough:
acme.sh --issue --server letsencrypt -d 203.0.113.195 -w /home/username/public_html --certificate-profile shortlived --days 6
Notes
- The available profile names depend on the selected CA.
- If you do not specify
--cert-profile, the default profile is used. - Always check your CA’s documentation for supported profile names and their characteristics.