Automating SSL Renewals in GitHub Actions with acme.sh

Описание и применение

Автоматизация обновления SSL‑сертификатов в GitHub Actions с acme.sh устранила ручной труд, обеспечила централизованный аудит и защиту от компрометации действий.

Задача

Manual SSL certificate renewals every 90 days created unsustainable operational debt and blind spots such as missing audit trails, unnoticed failures, inconsistent tool versions, and required manual DNS validation.

Результат

Automated SSL renewal pipeline reduced manual effort, eliminated blind spots, and prevented certificate expiry incidents. Pinning actions and weekly Dependabot updates mitigated supply‑chain risk.

Рабочий процесс

• Schedule weekly renewal job on Sunday 2 AM UTC
• Checkout pinned acme.sh release
• Cache acme.sh account data
• Install acme.sh without cron
• Issue certificate with DNS validation via Cloudflare
• Upload certificate and key to AWS Secrets Manager
• Upload logs on failure

Доказательства

When our infrastructure team inherited a legacy deployment pipeline that required manual SSL certificate renewals every 90 days, the operational debt became unsustainable.

Источник

This workflow runs on a schedule and can be triggered manually.

Источник

Pin all actions to full commit SHAs (not tags, which are mutable)

Источник