GitHub | Gitee | License: GPL-3.0 |
本网页客户端(仅一个静态HTML网页文件)用于:向 Let’s Encrypt、ZeroSSL、Google 等支持 ACME 协议的证书颁发机构,免费申请获得用于 HTTPS 的 SSL/TLS 域名证书(RSA
、ECC/ECDSA
),支持多域名和通配符泛域名;只需在现代浏览器上操作即可获得 PEM 格式纯文本的域名证书,不依赖操作系统环境(Windows、macOS都能用),无需下载和安装软件,无需注册登录,纯手动操作,只专注于申请获得证书这一件事,简单易用,非常适用于希望手动快捷申请获得证书的使用场景。
在线使用网址(GitHub): https://xiangyuecn.github.io/ACME-HTML-Web-Browser-Client/ACME-HTML-Web-Browser-Client.html
交流与支持:欢迎加QQ群 421882406
,纯小写口令 xiangyuecn
。如需功能定制,网站、App、小程序、前端和后端等开发需求,请加此QQ群,联系群主(即作者),谢谢~
This web client (only a single static HTML web page file) is used to: apply for free SSL/TLS domain name certificates (RSA
, ECC/ECDSA
) for HTTPS from Let’s Encrypt , ZeroSSL , Google and other certificate authorities that support the ACME protocol, and support multiple domain names and wildcard pan-domain names; Simply operate on a modern browser to obtain a domain name certificate in plain text in PEM format, does not depend on the operating system environment (both Windows and macOS can be used), does not need to download and install software, does not need to register and log in, and is purely manual, only focus on the only thing that is to apply for and obtain a certificate, which is simple and easy to use, It is very suitable for scenarios where you want to apply for certificates manually and quickly.
Online website (GitHub): https://xiangyuecn.github.io/ACME-HTML-Web-Browser-Client/ACME-HTML-Web-Browser-Client.html
Communication and support: Welcome to join the QQ group 421882406
, code xiangyuecn
. If you need function customization, website, app, applet, front-end and back-end development needs, please join this QQ group and contact the group owner (ie the author), thank you~
超级兼容
:不限操作系统、无需考虑运行环境,只需用你常用的浏览器打开网页即可申请证书。功能丰富
:支持申请RSA
或ECC(ECDSA)
证书,支持多域名和通配符,支持多个证书颁发机构。简单易用
:点点鼠标 Ctrl+C Ctrl+V 就能完成证书的申请,全程需要的操作少,每一步都有保姆级操作提示,UI友好大气美观;本客户端不需要注册账号、更不需要登录。单一文件
:本网页客户端仅一个静态 HTML 文件,不依赖其他任何文件;因此可以直接保存到你本地,即可通过浏览器打开。数据安全
:除了你指定证书颁发机构的 ACME 接口地址外,本网页客户端不会向其他任何地址发送数据,通过浏览器控制台很容易做到网络数据审查。系统安全
:纯网页应用,不会也无法对你的电脑系统做出任何修改。Super Compatibility
: No operating system restrictions, no need to consider the operating environment, just use your common browser to open the web page to apply for a certificate.Rich functions
: Support to apply for RSA
or ECC(ECDSA)
certificate, support multiple domain names and wildcards, and support multiple certificate authorities.Easy to use
: Click the mouse and Ctrl+C Ctrl+V to complete the certificate application. The whole process requires less operations, and there are nanny level operation prompts at each step; UI friendly, atmospheric and beautiful; This client does not need to register an account, and does not need to log in.A single file
: This web client is only a single static HTML web page file and does not depend on any other files; therefore, it can be directly saved to your local, and you can open it through a browser.Data security
: Except for the ACME interface address of the certificate authority you specify, this web client will not send data to any other address, and it is easy to check the network data through the browser console.System security
: Pure web application, will not and cannot make any modification to your computer system.Certificate Expiration Risk Alert: Since this web client can only be operated manually and does not support automatic renewal, you should pay attention to apply for a new certificate before the certificate expires (free certificates are generally valid for 90 days, you only need to repeat the operation at that time), or use acme.sh and other client automatic renewal.
证书过期风险提醒:由于本网页客户端只能纯手动操作,不支持自动续期,需注意在证书过期前重新生申请新证书(免费证书普遍90天有效期,届时只需重复操作一遍即可),或使用 acme.sh 等客户端自动化续期。
得益于现代浏览器的 crypto.subtle 对加密功能标准化,不依赖其他任何js库就能在网页上实现 RSA
、ECC
的加密、解密、签名、验证、和密钥对生成。在本客户端内的 X509
对象中:用 X509.CreateCSR 来生成CSR,用 X509.KeyGenerate 来创建PEM格式密钥,用 X509.KeyParse 来解析PEM格式密钥,用 X509.KeyExport 来导出PEM格式密钥;这些功能都是根据相应的标准用js代码在二进制层面上实现的,二进制数据操作封装在了 ASN1
对象中:实现了 ASN.1 标准的二进制解析和封包,使用 ASN1.ParsePEM 方法可以解析任意的PEM格式密钥或证书。以上这些都是实现ACME网页客户端的核心基础。
然后就是对接ACME实现证书的签发,和实现交互UI;对接ACME可以直接参考 RFC 8555 标准。有些证书颁发机构的ACME服务对浏览器支持不良,未提供齐全的 Access-Control-*
响应头,导致网页内无法直接调用服务接口;目前采用的解决办法非常简单粗暴,比如ZeroSSL:检测到此ACME服务存在跨域问题时,会调用 acmeReadDirGotoCORS()
方法告诉用户操作步骤(你可以手动调用此方法),通过在他们的页面内运行本客户端来消除跨域问题(既然打不过,那就加入他们)。
Thanks to the standardization of encryption functions by crypto.subtle of modern browsers, RSA
and ECC
encryption, decryption, signature, verification, and key pair generation can be implemented on web pages without relying on any other js library. In the X509
object in this client: use X509.CreateCSR to generate CSR, use X509.KeyGenerate to create PEM format key, use X509.KeyParse to parse PEM format key, use X509.KeyExport to export PEM format key; These functions are implemented at the binary level with js code according to the corresponding standards, and binary data operations are encapsulated in ASN1
objects: ASN.1 standard binary parsing and encapsulation are implemented, Arbitrary PEM format keys or certificates can be parsed using the ASN1.ParsePEM method. These are the core foundations for implementing the ACME web client.
Then it is to connect with ACME to realize certificate issuance and realize interactive UI; for connecting with ACME, you can directly refer to the RFC 8555 standard. The ACME services of some certificate authorities do not support browsers well, and do not provide complete Access-Control-*
response headers, so that the service interface cannot be called directly in the web page; the current solution is very simple and rude, such as ZeroSSL: detect this ACME When there is a cross-domain problem with the service, the acmeReadDirGotoCORS()
method will be called to tell the user the operation steps (you can call this method manually), and the cross-domain problem will be eliminated by running this client in their page (if we can’t beat them, we’d better join them).
README和HTML的中英对照翻译主要来自:Chrome自带翻译+百度翻译,由中文翻译成English(作者英文很菜)。另外为什么没有拆分成每个语言一个文件,非要混乱的搞在一起:作者头已秃,文件多了怕心智负担太重 :) 。
如果你不需要自动化续期,只想手动申请获得证书,使用本网页版的客户端是一个很不错的选择。
可能正是因为手动操作、且不支持自动续期的原因,Let's Encrypt
官网的ACME客户端列表中特别的不提供浏览器版的客户端;导致对于仅想获得证书,并不需要自动化功能的用户,不得不小心翼翼的使用那些不容易使用的客户端。
之前我一直通过 diafygi/gethttpsforfree
网页来申请证书,但操作太复杂了,从官网中又找不到更好的网页客户端,所以我就自己写代码做了一个,欢迎使用。
The Chinese-English translation of README and HTML mainly comes from: Chrome comes with translation + Baidu translation, which is translated from Chinese to English (the author’s English level is very low). In addition, why is it not split into one file for each language, and it has to be cluttered together: the author’s head is bald, and there are too many files for fear that the mental burden will be too heavy :) .
If you don’t need automatic renewal and just want to apply for a certificate manually, using this web page client is a good choice.
It may be because of manual operation and the fact that automatic renewal is not supported. The ACME client list on the Let's Encrypt
official website does not provide a browser version of the client. As a result, users who only want to obtain certificates and do not need automation functions, they can only choose to use those clients that are not easy to use.
I have been applying for a certificate through the diafygi/gethttpsforfree
webpage before, but the operation was too complicated, and I couldn’t find a better web client from the official website, so I wrote my own code and made one, welcome to use.
如果这个项目有帮助到您,欢迎 Star 一下方便以后找得到。
If this project is helpful to you, welcome Star, it will be convenient to find it in the future.
您也可以使用支付宝或微信打赏作者: