Manual acme.sh

Read-only template with one leading space before export. Fill in your token in the terminal before running.

 export CF_Token=""

acme.sh --issue \
  --dns dns_cf \
  -d example.com \
  --keylength ec-256

mkdir -p /etc/nginx/ssl/example.com

acme.sh --install-cert -d example.com --ecc \
  --key-file /etc/nginx/ssl/example.com/privkey.pem \
  --fullchain-file /etc/nginx/ssl/example.com/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

ssl_certificate /etc/nginx/ssl/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com/privkey.pem;

Common paths & commands

Certificate paths follow your inputs. Common Linux paths may differ by installation. Run commands on your server with the required permissions.

Optional: DH parameters are for DHE ciphers, not required for ECDHE. Generate the file before adding ssl_dhparam; generation may take time. The command skips an existing file.

/etc/nginx/ssl/example.com/privkey.pem

/etc/nginx/ssl/example.com/fullchain.pem

/etc/nginx/ssl/dhparam.pem

mkdir -p /etc/nginx/ssl/ && if [ ! -e /etc/nginx/ssl/dhparam.pem ]; then
  openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
fi

ssl_dhparam /etc/nginx/ssl/dhparam.pem;

openssl x509 -in /etc/nginx/ssl/example.com/fullchain.pem -noout -subject -issuer -dates

openssl x509 -in /etc/nginx/ssl/example.com/fullchain.pem -noout -checkend 2592000

/etc/nginx/nginx.conf

~/.acme.sh/

nginx -t

nginx -t && systemctl reload nginx