Automating SSL Renewals in GitHub Actions with acme.sh

说明与用途

使用 acme.sh 在 GitHub Actions 中自动续签 SSL 证书，消除了手动操作，集中审计并防止了操作供应链攻击。

问题

Manual SSL certificate renewals every 90 days created unsustainable operational debt and blind spots such as missing audit trails, unnoticed failures, inconsistent tool versions, and required manual DNS validation.

结果

Automated SSL renewal pipeline reduced manual effort, eliminated blind spots, and prevented certificate expiry incidents. Pinning actions and weekly Dependabot updates mitigated supply‑chain risk.

工作流

• Schedule weekly renewal job on Sunday 2 AM UTC
• Checkout pinned acme.sh release
• Cache acme.sh account data
• Install acme.sh without cron
• Issue certificate with DNS validation via Cloudflare
• Upload certificate and key to AWS Secrets Manager
• Upload logs on failure

证据

When our infrastructure team inherited a legacy deployment pipeline that required manual SSL certificate renewals every 90 days, the operational debt became unsustainable.

来源

This workflow runs on a schedule and can be triggered manually.

来源

Pin all actions to full commit SHAs (not tags, which are mutable)

来源