The conclusion is that integrating acme.sh into GitHub Actions significantly reduces operational incidents, with unattended workflows, Slack failure notifications, and certificate metrics feeding observability, validated across more than 40 domains handling over 2 million requests daily over 18 months without expiry-related issues.

A prior incident in March 2025 prompted policies to pin actions to full commit SHAs and to conduct weekly Dependabot PR reviews for updating pinned SHAs.

The workflow sequence includes checking out a pinned acme.sh release, caching account data, installing acme.sh, issuing certificates via DNS validation (illustrated with Cloudflare DNS), and securely uploading base64-encoded certificate and key to a secrets manager with failure logging.

Production lessons emphasize concurrency control to dodge Let's Encrypt rate limits, the value of versioned cache keys to prevent stale data, and isolating matrix builds to limit blast radius, even if that means longer total wall-clock time.

Deliverable 2 introduces a pre-deployment validation script that enforces certificate quality gates before production, including a expiry threshold above 30 days, SAN coverage for the domain, and a complete certificate chain.

Deliverable 1 describes a hardened GitHub Actions workflow that runs weekly on Sunday at 2 AM UTC with optional manual triggers, supports multiple domains, and uses pinned acme.sh releases for reproducibility.

The identified problems included a lack of centralized audit trails, undetected failed renewals, inconsistent acme.sh versions, and reliance on manual DNS validation, which motivated CI/CD integration.

The article outlines automating SSL certificate renewals in GitHub Actions with acme.sh to replace manual, VM-based renewal processes and prevent production incidents from certificate expiry.