Automating SSL Renewals in GitHub Actions with acme.sh

Description and use

Automating SSL renewals in GitHub Actions with acme.sh eliminated manual effort, centralized audit, and protected against action supply‑chain attacks.

Problem

Manual SSL certificate renewals every 90 days created unsustainable operational debt and blind spots such as missing audit trails, unnoticed failures, inconsistent tool versions, and required manual DNS validation.

Outcome

Automated SSL renewal pipeline reduced manual effort, eliminated blind spots, and prevented certificate expiry incidents. Pinning actions and weekly Dependabot updates mitigated supply‑chain risk.

Workflow

• Schedule weekly renewal job on Sunday 2 AM UTC
• Checkout pinned acme.sh release
• Cache acme.sh account data
• Install acme.sh without cron
• Issue certificate with DNS validation via Cloudflare
• Upload certificate and key to AWS Secrets Manager
• Upload logs on failure

Evidence

When our infrastructure team inherited a legacy deployment pipeline that required manual SSL certificate renewals every 90 days, the operational debt became unsustainable.

Source

This workflow runs on a schedule and can be triggered manually.

Source

Pin all actions to full commit SHAs (not tags, which are mutable)

Source