{"id":"3bbb511a-b726-4e07-81c6-65ee18a258bb","task":"Issue a wildcard TLS certificate with acme.sh using a DNS-01 API provider (Cloudflare as the worked example), and understand how unattended renewal happens via the cron job the acme.sh installer sets up.","domain":"github.com/acmesh-official/acme.sh","steps":["Create a Cloudflare API Token with the 'Zone > DNS > Edit' permission scoped to your zone(s): User Token at https://dash.cloudflare.com/profile/api-tokens, or an Account-owned Token via Cloudflare Dashboard -> Manage Account -> Account API Tokens.","Export credentials for the token method: export CF_Token=\"<your-token>\" ; export CF_Account_ID=\"<account-id>\"  (use CF_Zone_ID instead of CF_Account_ID if issuing for only a single Cloudflare zone).","Issue the apex + wildcard cert via the dns_cf DNS hook: acme.sh --issue --dns dns_cf -d example.com -d '*.example.com'","(Legacy, not recommended by the wiki) Global API Key method: export CF_Key=\"<global-api-key>\" ; export CF_Email=\"you@example.com\"  then run the same --issue --dns dns_cf command.","Install/deploy the issued cert with a reload command: acme.sh --install-cert -d example.com --fullchain-file /path/fullchain.pem --key-file /path/key.pem --reloadcmd \"service nginx force-reload\"","No manual renewal step is needed: the CF_Token/CF_Account_ID (or CF_Key/CF_Email) used at issuance are saved into ~/.acme.sh/account.conf and reused automatically when the installer's daily cron job runs acme.sh --cron.","Official docs: https://github.com/acmesh-official/acme.sh/wiki/dnsapi, https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert, https://github.com/acmesh-official/acme.sh"],"gotchas":["The dnsapi wiki lists 3 Cloudflare credential methods: User Token (CF_Token + CF_Zone_ID for one zone), Account-owned Token (CF_Token + CF_Account_ID for multiple zones in one account), or the legacy Global API Key (CF_Key + CF_Email), which the wiki explicitly marks 'Not recommended' since leaking it compromises the whole Cloudflare account.","Wildcard certs (*.example.com) can only be validated via DNS-01 — webroot, standalone, apache, and nginx modes cannot issue wildcard certs, only --dns modes can.","For domains spanning multiple different Cloudflare accounts, you must run --issue separately per account/domain group with that account's own CF_Token/CF_Account_ID exported each time.","The renewal cron reuses saved env vars from ~/.acme.sh/account.conf, so CF_Token does NOT need to stay exported in your interactive shell for unattended renewals to keep working.","Certs still follow the general 30-day (or earlier, ARI-driven RFC 9773) renewal cadence described in the main README — dns_cf issuance doesn't change that schedule, only how the challenge is solved.","DNS manual mode (acme.sh --issue --dns, with no provider name) is different from DNS API mode (--dns dns_cf): manual mode cannot auto-renew and requires re-adding a TXT record by hand every time; only API-driven modes like dns_cf support unattended cron renewal."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T06:05:13.676Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T06:05:13.676Z"},"url":"https://mcp.waymark.network/r/3bbb511a-b726-4e07-81c6-65ee18a258bb"}