Validity - acmesh-official/acme.sh GitHub Wiki

The ACME protocol supported the NotBefore and NotAfter fields of the cert. And some of the CAs supported this feature. (The Letsencrypt CA doesn't support it for now. If you want short-lived certs from Letsencrypt, use profile selection instead.)

There are 2 command options to use:

1. The --valid-to <date time> option, which is for NotAfter field.
2. The --valid-from <date time> option, which is for NotBefore field.

Usage:

acme.sh --issue  -d  example.com  --dns dns_cf    --valid-to  "2022-04-01T08:10:33Z"

The value of --valid-to is an absolute date time in the future. The issued cert will expire on that time(NotAfter).

Please be careful about the date time format, it Must be the exact format in UTC used above.

You can also use a relative date time format:

# This cert will only be valid for `10` days.

acme.sh  --issue  -d example.com --dns dns_cf   --valid-to  "+10d"


# This cert will be valid for `30` hours.

acme.sh  --issue  -d example.com --dns dns_cf   --valid-to  "+30h"

Please be careful about the format, there are only +*d (for days) and +*h (for hours) supported for now. Any other format will not be accepted.

1. --valid-to +20d(the cert will be renewed every 19 days). If the lifetime is longer than one day, it will renew at one day before.
2. --valid-to +11h(the cert will be renewed every 10 hours). If the lifetime is less than 24 hours, it will renew at one hour before.

By default, a cert issued with a relative --valid-to renews 1 day before the expiry (or 1 hour before, if the lifetime is 24 hours or less). If that safety margin is too small for you, pass a negative --days together with the relative --valid-to to renew that many days before the expiry:

# A 30-day cert, renewed 7 days before the expiry (so it renews every 23 days):

acme.sh  --issue  -d example.com --dns dns_cf   --valid-to "+30d"  --days -7


# A 47-day cert, renewed 5 days before the expiry:

acme.sh  --issue  -d example.com --dns dns_cf   --valid-to "+47d"  --days -5

A negative --days is anchored to the expiry time, so it composes naturally with --valid-to.

Notes:

1. A positive --days is anchored to the cert creation time, so it can NOT be used together with --valid-to: it is rejected with an error.
2. Any --days combined with an absolute date --valid-to is rejected too: such a cert can not be renewed automatically anyway.
3. A negative --days also works without --valid-to: the cert keeps the CA's default lifetime and renews that many days before the expiry. For example, --days -5 renews 5 days before the expiry, whatever the lifetime is.
4. If the CA supports ARI, the renewal time suggested by the CA overrides the scheduled one. Set NO_ARI=1 to opt out.

acme.sh  --issue  -d example.com --dns dns_cf   --valid-from  "2022-04-01T08:10:33Z"

The cert time will be valid starting from "2022-04-01T08:10:33Z".

You can also use the relative time format:

#The cert will be valid in 2 hours from now:

acme.sh  --issue  -d example.com --dns dns_cf   --valid-from  "+2h"


#The cert will be valid in 1 day from now:

acme.sh  --issue  -d example.com --dns dns_cf   --valid-from  "+1d"

# The cert will be valid from `"2022-04-01T08:10:33Z"`, and then live for 40 days to expire:

acme.sh  --issue  -d example.com --dns dns_cf   --valid-from  "2022-04-01T08:10:33Z"   --valid-to "+40d"


# The cert will be valid in 2 hours, and then live for 50 days to expire:

acme.sh  --issue  -d example.com --dns dns_cf   --valid-from  "+2h"  --valid-to "+50d"

0 * * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null