Functional useThis web client is used to: apply for free SSL/TLS domain name certificates (RSA, ECC/ECDSA) for HTTPS from Let's Encrypt , ZeroSSL , Google and other certificate authorities that support the ACME protocol, and support multiple domain names and wildcard pan-domain names, some certificate authorities support IP certificates (IPv4, IPv6); Simply operate on a modern browser to obtain a domain name certificate in plain text in PEM format, does not depend on the operating system environment, does not need to download and install software, and is purely manual, only focus on the only thing that is to apply for and obtain a certificate.
Easy to useClick the mouse and Ctrl+C Ctrl+V to complete the certificate application. The whole process requires less operations, and there are nanny level operation prompts at each step; UI friendly, atmospheric and beautiful; This client does not need to register an account, and does not need to log in.
开源项目本网页客户端源码已开源，访问网址由托管仓库提供，源码透明可追溯。
Open source projectThe source code of the client side of this webpage has been open sourced, and the access URL is provided by the hosting warehouse, and the source code is transparent and traceable.
单一文件本网页客户端仅一个静态 HTML 文件，不依赖其他任何文件；因此可以直接保存到你本地（右键-另存为），即可通过浏览器打开。
A single fileThis web client is only a single static HTML web page file and does not depend on any other files; therefore, it can be directly saved to your local (right-click - save as), and you can open it through a browser.
Data securityExcept for the ACME interface address of the certificate authority you specify, this web client will not send data to any other address, and it is easy to check the network data through the browser console.
系统安全纯网页应用，不会也无法对你的电脑系统做出任何修改。
System securityPure web application, will not and cannot make any modification to your computer system.
Certificate Expiration Risk AlertSince this web client can only be operated manually and does not support automatic renewal, you should pay attention to apply for a new certificate before the certificate expires (free certificates are generally valid for 90 days, you only need to repeat the operation at that time), or use acme.sh and other client automatic renewal.
ZeroSSL:
此URL可能需要先根据下面的提示进行操作来消除跨域不能访问的问题。申请证书前，你需要根据ZeroSSL的官方文档，先注册ZeroSSL账号并生成一个EAB凭据，每次申请证书时使用此EAB凭据，按照下面的操作步骤提示进行申请即可得到证书，证书有效期90天。Before applying for a certificate, you need to follow ZeroSSL's official documents, register a ZeroSSL account and generate an EAB credential, and use this EAB credential every time you apply for a certificate, follow the operation steps prompts below to apply, and you can get the certificate, which is valid for 90 days.[2026-01]ZeroSSL证书签发服务可能不稳定，如果反复出现重试或长时间等待，第二天再试可能恢复正常。
Google Trust Services:
此URL可能需要先根据下面的提示进行操作来消除跨域不能访问的问题。申请证书前，你需要根据Google的官方文档，在Google Cloud中生成一个EAB凭据，每次申请证书时使用此EAB凭据，按照下面的操作步骤提示进行申请即可得到证书，证书有效期90天。Before applying for a certificate, you need to follow Google's official documents, generate an EAB credential in Google Cloud, and use this EAB credential every time you apply for a certificate, follow the operation steps prompts below to apply, and you can get the certificate, which is valid for 90 days.注意：因为同一个Google EAB凭据只能绑定到一个ACME账户（私钥），因此你在首次申请证书时，必须同时保存好在第二步操作中新创建的或手动填写的ACME账户私钥，下次申请证书时使用此EAB凭据必须和已保存的ACME账户私钥一起使用。Note: Because the same Google EAB credential can only be bound to one ACME account (Private key), when you apply for a certificate for the first time, you must also save the newly generated or manually filled ACME account private key in the second step, this EAB credential must be used together with the saved ACME account private key when applying for a certificate next time.
一个证书可以包含多个域名（支持通配符），比如填写：a.com, *.a.com, b.com, *.b.com, 111.0.0.1, fe22:2ab::2；第一个域名（IP除外）将作为证书的通用名称（Common Name）；带通配符的域名只支持DNS验证，其他域名支持上传文件验证；注意：填了www.a.com时，一般需要额外填上a.com。部分证书颁发机构支持填写IP地址（IPv4或IPv6），但可能需要正确选择ACME Profile才能完成签发。A certificate can contain multiple domain names (wildcard are supported), for example, fill in: a.com, *.a.com, b.com, *.b.com, 111.0.0.1, fe22:2ab::2; the first domain name (excluding IP) will be used as the Common Name of the certificate; Domain names with wildcard only support DNS verification, and other domain names support upload file verification ; Note: When www.a.com is filled in, it is generally necessary to fill in a.com additionally. Some certificate authorities support entering an IP address (IPv4 or IPv6), but you may need to select the correct ACME Profile to complete the issuance.
生成或填写的私钥仅用于ACME接口签名，支持RSA(2048位+)、ECC(prime256v1、secp384r1、secp521r1曲线)私钥；注意：证书私钥的类型决定了申请到的证书是RSA证书还是ECC(ECDSA)证书，RSA类型适用性更广也更常见；本客户端不会对此私钥进行保存或发送给其他任何人；证书签发后在部署到服务器时，需使用到此私钥；建议每次申请证书时均生成新的证书私钥。The generated or filled private key is only used for ACME interface signature, and supports RSA (2048-bit+) and ECC (prime256v1、secp384r1、secp521r1 curve) private keys; Note: The type of certificate private key determines whether the applied certificate is an RSA certificate or a ECC(ECDSA) certificate, RSA type is more widely applicable and more common; this client will not save or send this private key to anyone else; this private key needs to be used when deploying to the server after the certificate is issued; it is recommended to generate a new certificate private key every time you apply for a certificate.
*ACME账户的私钥：
生成或填写的私钥仅用于ACME接口签名，支持RSA(2048位+)、ECC(prime256v1、secp384r1、secp521r1曲线)私钥；账户私钥类型对证书无影响；本客户端不会对此私钥进行保存或发送给其他任何人；一个私钥相当于一个账户，可用于吊销已签发的证书；建议每次申请证书时使用相同的一个私钥（这样短期内多次申请证书时，验证域名所有权的参数极有可能会保持相同），不过每次都生成一个新的私钥大部分情况下也不会有问题。The generated or filled private key is only used for ACME interface signature, and supports RSA (2048-bit+) and ECC (prime256v1、secp384r1、secp521r1 curve) private keys; the account private key type has no effect on the certificate; this client will not save or send this private key to anyone else; A private key is equivalent to an account and can be used to revoke an issued certificate; it is recommended to use the same private key every time you apply for a certificate (in this way, the parameters used to verify the domain name ownership are likely to remain identical when multiple certificate applications are made in a short period of time); However, generating a new private key every time will not be a problem in most cases.注意：如果你选择的ACME服务（比如Google）要求提供EAB凭据并且限制了同一个EAB凭据只能绑定到一个ACME账户（私钥），那每次使用此EAB凭据时必须使用相同的一个私钥（首次时如果新创建了私钥，此新私钥需立即保存起来下次和此EAB凭据一起使用）。
请每个域名选择好对应的验证方式，根据显示的提示进行对应的配置操作；必须所有域名配置完成后，再来点击下面的“开始验证”按钮进行验证，如果验证失败、或验证耗时太久，需要返回第二步重新开始操作。Please select the corresponding verify method for each domain name, and perform the corresponding configuration operation according to the displayed prompts; after all domain names are configured, click the "Start Verify" button below to verify, if the verify fails or takes too long, you need to go back to the step 2 Start the operation.
开始验证取消重试
步骤四：下载保存证书PEM文件
等待中，请先完成第三步...
*保存证书PEM文件：
必须保存此文件，请点击下载按钮下载，或者将证书文本内容复制保存为your_domain.pem文件（PEM纯文本格式）；文件名后缀可改成 .crt 或 .cer，这样在Windows中能直接双击打开查看。本PEM格式文件已包含你的域名证书、和完整证书链，文本中第一个CERTIFICATE为你的域名证书，后面的为证书颁发机构的中间证书和根证书，如过有需要你可以自行拆分成多个.pem文件。This file must be saved, please click the download button to download, or copy the text content of the certificate and save it as your_domain.pem file (PEM plain text format); the file name suffix can be changed to .crt or .cer , so that it can be directly double-clicked to open and view in Windows. This PEM format file already contains your domain name certificate and complete certificate chain. The first CERTIFICATE in the text is your domain name certificate, followed by the intermediate certificate and root certificate of the certificate authority, if necessary, you can split it into multiple .pem files.
下载保存
*保存证书私钥KEY文件：
请点击下载按钮下载，或者将私钥文本内容复制保存为your_domain.key文件（PEM纯文本格式，.key后缀可自行修改成.pem）。如果第二步操作中你手动填写了证书私钥，此处的证书私钥和你填写的是完全一样的，可以不需要重复保存；如果你是新创建的证书私钥，则你必须下载保存此证书私钥文件。Please click the download button to download, or copy and save the text content of the private key as your_domain.key file (PEM plain text format, the .key suffix can be modified to .pem by yourself). If you manually filled in the certificate private key in the step 2, the certificate private key here is exactly the same as what you filled in, and you don’t need to save it repeatedly; if you are a newly created certificate private key, you must download and save it This certificate private key file.