Can ACME.sh run on mainframe USS?

[dickywmc]

I noticed ACME.sh has been certified to run on quite a large number of OS, but has any testing been done to see whether ACME.sh can run on mainframe USS (Unix System Services)? It is because mainframe also has a requirement to do certificate renewal and management. Thanks.

[Neilpang]

I have never heard about this USS. can you share more details?

[dickywmc]

USS (Unix System Services) is a UNIX shell under IBM mainframe. It enables Linux applications to run in mainframe.

Now if ACME.sh can run in USS that would enable mainframe certificates to get renewed.

[chandave]

If USS is Linux-like (i.e. has tar, gunzip, grep, sed, bourne shell/bash, etc.) then acme.sh should run without issue IF you are using webroot, standalone, standalone tls-alpn, apache, or nginx mode for host-based verification. If you plan on using domain-based verification then there will be additional requirements. To find the requirements, it is best to read the shell script for whichever domain-based verification you plan to use. Those shell scripts are in the dnsapi directory.

In case you still haven't found out how to get the tarfile or zip file of acme.sh:

1. Goto https://github.com/acmesh-official/acme.sh in a web browser
2. On the right-hand side of the webpage, you will see "Releases", click on that link.
3. Under, "Assets" there should be 2 links, one for a zip file and one for a tar file.

See ya...

d.c.

[webprofusion-chrisc]

Consider also just renewing your certificates elsewhere and copying them onto the mainframe or pull them from a secrets vault like Hashicorp Vault, Azure Keyvault etc.

You don't strictly need to do ACME renewals directly on the server that needs the certs and I'd be worried if you were using http domain validation on an older OS directly connected to the internet.

[GarryGGreen]

You are correct - you could run a more "standard" ACME Client on Windows or Linux (I do on my personal system for my VPN and HTTPS servers), and then upload the certificates to the Mainframe, then notify the admin that it needs to be tested. Once tested, the old cert/key could be removed from the servers during a scheduled recycle and cut over to the new ones? I noticed that the ACME.SH is a Bourne Shell (therefore is this UNIX or LINUX based or does it matter)? It seems to issue a CURL command. I've found doc that CURL has been ported to the Mainframe, with a URL link that says no such thing and IBM's doc - not a word. And please bear with me - I'm a Mainframer learning other platforms.