When a domain is not connected to a specific web host but still needs an SSL certificate, acme.sh can issue one through its manual DNS mode. This method verifies domain ownership by asking you to create DNS TXT records rather than placing validation files on a website.
The main limitation is that manual DNS mode does not renew certificates automatically. Certificates are valid for 90 days, so renewal must be monitored and performed manually.
Installing acme.sh
Install acme.sh with either curl or wget:
curl https://get.acme.sh | sh -s [email protected]`
or:
wget -O - https://get.acme.sh | sh -s [email protected]
Requesting a certificate with DNS mode
The following command requests a certificate for both optipng.cn and www.optipng.cn:
acme.sh --issue --dns -d optipng.cn -d www.optipng.cn --yes-I-know-dns-manual-mode-enough-go-ahead-please
Because manual DNS validation is being used, acme.sh displays the TXT records that must be added to the DNS zone. A sample output is shown below:
... ...
[Mon Nov 17 07:17:54 PM PST 2025] Sleeping for 10 seconds and retrying.
[Mon Nov 17 07:18:05 PM PST 2025] Using CA: https://acme.zerossl.com/v2/DV90
[Mon Nov 17 07:18:05 PM PST 2025] Account key creation OK.
[Mon Nov 17 07:18:05 PM PST 2025] No EAB credentials found for ZeroSSL, let's obtain them
[Mon Nov 17 07:18:06 PM PST 2025] Registering account: https://acme.zerossl.com/v2/DV90
[Mon Nov 17 07:18:06 PM PST 2025] Could not get nonce, let's try again.
[Mon Nov 17 07:18:09 PM PST 2025] Could not get nonce, let's try again.
[Mon Nov 17 07:18:13 PM PST 2025] Could not get nonce, let's try again.
[Mon Nov 17 07:18:16 PM PST 2025] Registered
[Mon Nov 17 07:18:16 PM PST 2025] ACCOUNT_THUMBPRINT='39EcpbbsWhtdSzzd8Rz-z3kXNzpzadw0Vmq6wS2xIKY'
[Mon Nov 17 07:18:16 PM PST 2025] Creating domain key
[Mon Nov 17 07:18:16 PM PST 2025] The domain key is here: /root/.acme.sh/optipng.cn_ecc/optipng.cn.key
[Mon Nov 17 07:18:16 PM PST 2025] Multi domain='DNS:optipng.cn,DNS:www.optipng.cn'
[Mon Nov 17 07:18:17 PM PST 2025] Getting webroot for domain='optipng.cn'
[Mon Nov 17 07:18:17 PM PST 2025] Getting webroot for domain='www.optipng.cn'
[Mon Nov 17 07:18:17 PM PST 2025] Add the following TXT record:
[Mon Nov 17 07:18:17 PM PST 2025] Domain: '_acme-challenge.optipng.cn'
[Mon Nov 17 07:18:17 PM PST 2025] TXT value: 'VTtpEviHUIZZz4wCu9RWR4yJBTNkIE1t1vw9cuGv6-g'
[Mon Nov 17 07:18:17 PM PST 2025] Please make sure to prepend '_acme-challenge.' to your domain
[Mon Nov 17 07:18:17 PM PST 2025] so that the resulting subdomain is: _acme-challenge.optipng.cn
[Mon Nov 17 07:18:17 PM PST 2025] Add the following TXT record:
[Mon Nov 17 07:18:17 PM PST 2025] Domain: '_acme-challenge.www.optipng.cn'
[Mon Nov 17 07:18:17 PM PST 2025] TXT value: 'zp-ntPgXeUX_TZO7NZaeNCeX_AJqTc76OV7Z-s5axRY'
[Mon Nov 17 07:18:17 PM PST 2025] Please make sure to prepend '_acme-challenge.' to your domain
[Mon Nov 17 07:18:17 PM PST 2025] so that the resulting subdomain is: _acme-challenge.www.optipng.cn
[Mon Nov 17 07:18:17 PM PST 2025] Please add the TXT records to the domains, and re-run with --renew.
[Mon Nov 17 07:18:17 PM PST 2025] Please add '--debug' or '--log' to see more information.
[Mon Nov 17 07:18:17 PM PST 2025] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
Adding the DNS records and completing issuance
In the DNS management panel, create the two TXT records requested by the command:
_acme-challenge.optipng.cn_acme-challenge.www.optipng.cn
Use the corresponding TXT values printed in the output. DNS changes generally take about a minute to become available. Once the records have propagated, run the renewal command below to let acme.sh verify them and finish issuing the certificate:
acme.sh --renew --dns -d optipng.cn -d www.optipng.cn --yes-I-know-dns-manual-mode-enough-go-ahead-please
A successful run reports the locations of the certificate, private key, intermediate certificate, and full-chain certificate:
... ...
[Mon Nov 17 07:22:32 PM PST 2025] Your cert is in: /root/.acme.sh/optipng.cn_ecc/optipng.cn.cer
[Mon Nov 17 07:22:32 PM PST 2025] Your cert key is in: /root/.acme.sh/optipng.cn_ecc/optipng.cn.key
[Mon Nov 17 07:22:32 PM PST 2025] The intermediate CA cert is in: /root/.acme.sh/optipng.cn_ecc/ca.cer
[Mon Nov 17 07:22:32 PM PST 2025] And the full-chain cert is in: /root/.acme.sh/optipng.cn_ecc/fullchain.cer
The resulting files are stored under /root/.acme.sh/optipng.cn_ecc/, ready to be used by the service that will terminate TLS connections.