免费申请Let's Encrypt、ZeroSSL等HTTPS证书Free SSL certificates from Let's Encrypt, ZeroSSL and
more
⚡
简单易用
Easy to Use
无需注册账号，点击几下即可完成
No registration required, just a few
clicks
🛡️
安全可靠
Secure & Safe
开源透明，数据不会发送到第三方
Open source, no data sent to third
parties
🌐
支持多域名
Multi-Domain
支持通配符域名和多域名证书
Wildcard and multi-domain certificates
重要提醒：Important:免费证书有效期90天，需要手动续期Free certificates are valid for 90 days and require manual
renewal
步骤一：选择证书颁发机构Step 1: Select Certificate Authority
*选择证书颁发机构：Choose Certificate Authority:
Let's Encrypt:
请按照下面的操作步骤提示进行申请即可得到证书，证书有效期90天。Please follow the operation steps prompts below to
apply, and you can get
the certificate, which is valid for 90 days.
ZeroSSL:
此URL可能需要先根据下面的提示进行操作来消除跨域不能访问的问题。This URL may need to be operated according to
the prompts below to
eliminate the problem of cross-domain inaccessibility.申请证书前，你需要根据ZeroSSL的官方文档，先注册ZeroSSL账号并生成一个EAB凭据，每次申请证书时使用此EAB凭据，按照下面的操作步骤提示进行申请即可得到证书，证书有效期90天。Before applying for a certificate, you need to
follow ZeroSSL's official
documents,
register a ZeroSSL account and generate an EAB credential, and use this EAB credential every
time you apply for a certificate, follow the operation steps prompts below to apply, and you
can get the certificate, which is valid for 90 days.
Google Trust Services:
此URL可能需要先根据下面的提示进行操作来消除跨域不能访问的问题。This URL may need to be operated according to
the prompts below to
eliminate the problem of cross-domain inaccessibility.申请证书前，你需要根据Google的官方文档，在Google
Cloud中生成一个EAB凭据，每次申请证书时使用此EAB凭据，按照下面的操作步骤提示进行申请即可得到证书，证书有效期90天。Before applying for a certificate, you need to
follow Google's official documents, generate an EAB credential in Google Cloud, and
use this EAB credential every time you apply for a certificate, follow the operation steps
prompts below to apply, and you can get the certificate, which is valid for 90 days.注意：因为同一个Google EAB凭据只能绑定到一个ACME账户（私钥），因此你在首次申请证书时，必须同时保存好在第二步操作中新创建的或手动填写的ACME账户私钥，下次申请证书时使用此EAB凭据必须和已保存的ACME账户私钥一起使用。Note: Because the same Google EAB credential can
only be bound to one
ACME account (Private key), when you apply for a certificate for the first time, you must also save the newly generated or
manually filled ACME account private key in the second step, this EAB
credential must be used together with the saved ACME account private key when applying
for a certificate next time.
[09:50:14] 读取服务目录成功，Read service directory OK,请进行下一步操作。
Please proceed to the next step.
URL=https://acme-v02.api.letsencrypt.org/directory
请给每个域名选择一个你合适的验证方式（推荐采用DNS验证，比较简单和通用），然后根据显示的提示完成对应的配置操作。Please select a suitable verification method for each
domain name (DNS Verify
is recommended, which is relatively simple and common), and then complete the corresponding
configuration operations according to the displayed prompts.
请每个域名选择好对应的验证方式，根据显示的提示进行对应的配置操作；必须所有域名配置完成后，再来点击下面的“开始验证”按钮进行验证，如果验证失败，需要返回第二步重新开始操作。Please select the corresponding verify method for
each domain name, and
perform the corresponding configuration operation according to the displayed prompts; after all domain names are configured, click the "Start Verify"
button below to verify, if the verify fails, you need to go back to the step 2
Start the operation.
开始验证Start Verify取消Cancel重试Retry
步骤四：下载保存证书PEM文件Step 4: Download and save the certificate PEM file
必须保存此文件，请点击下载按钮下载，或者将证书文本内容复制保存为your_domain.pem文件（PEM纯文本格式）；文件名后缀可改成 .crt 或 .cer，这样在Windows中能直接双击打开查看。本PEM格式文件已包含你的域名证书、和完整证书链，文本中第一个CERTIFICATE为你的域名证书，后面的为证书颁发机构的中间证书和根证书，如过有需要你可以自行拆分成多个.pem文件。This file must be
saved, please click the
download button to download, or copy the text content of the certificate and save it as your_domain.pem file (PEM plain text format); the
file name suffix
can be changed to .crt or .cer , so that it can be
directly double-clicked to open and view in Windows. This PEM format file already contains
your domain name certificate and complete certificate chain. The first CERTIFICATE in the
text is your domain name certificate, followed by the intermediate certificate and root
certificate of the certificate authority, if necessary, you can split it into multiple .pem
files.
下载保存Download
*保存证书私钥KEY文件：Save the certificate private key KEY file:
请点击下载按钮下载，或者将私钥文本内容复制保存为your_domain.key文件（PEM纯文本格式，.key后缀可自行修改成.pem）。如果第二步操作中你手动填写了证书私钥，此处的证书私钥和你填写的是完全一样的，可以不需要重复保存；如果你是新创建的证书私钥，则你必须下载保存此证书私钥文件。Please click the download button to download, or
copy and save the text
content of the private key as your_domain.key file (PEM
plain text
format, the .key suffix can be modified to .pem by yourself). If you manually filled in the
certificate private key in the step 2, the certificate private key here is exactly the same
as what you filled in, and you don’t need to save it repeatedly; if
you are a newly created certificate private key, you must download and save it This
certificate private key file.
下载保存Download
*保存记录LOG文件：Save the record LOG file:
建议下载保存此文件，本记录文件包含了所有数据，包括：证书PEM文本、证书私钥PEM文本、账户私钥PEM文本、所有配置参数。下次你需要续签新证书时，可以将本记录文件直接拖拽进本页面，会自动填写所有参数。It is recommended to download and save this file.
This record file contains
all data, including: certificate PEM text, certificate private key PEM text, account private
key PEM text, and all configuration parameters. Next time you need to renew a new
certificate, you can drag and drop the record file directly into this page, and all
parameters will be filled in automatically.
下载保存Download
你需要其他格式的证书文件？Do you need certificate files in other formats?
大部分服务器程序支持直接使用 your_domain.pem+your_domain.key 来配置开启HTTPS（比如Nginx），如果你需要 *.pfx、*.p12 格式的证书（比如用于IIS），请用下面命令将PEM证书转换成 pfx/p12 格式：Most server programs support directly using your_domain.pem+your_domain.key to configure and
enable HTTPS (such as Nginx). If you need a certificate in *.pfx or *.p12 format (such as for IIS), please use the following command to convert
the PEM certificate Convert to pfx/p12 format: