Update: This method is no longer functional. This post is retained for archival purposes only.
Today I saw someone released both the method and the script publicly, so I looked into it and packaged it into an executable program.
Open source repository:
https://github.com/TheTNB/zerossl
Usage:
- Register an account on the official website (zerossl.com) (you need a VPN/proxy, as there is a hidden reCAPTCHA. You can use any random email, no verification is required), and save your account email and password.
- Download the binary for your platform from the open source repository linked above, unzip it and run it.
- Follow the prompts to enter your account credentials and domain name (you must enter a wildcard domain in the format *.xxx.com), then submit.
- Next, go to the Draft section in the admin panel on the official website to complete domain verification and issue the certificate.
- After the certificate is successfully issued, go to the Issued section to download your certificate.
certificate.crtis your domain certificate,ca_bundle.crtis the intermediate certificate. Append the content ofca_bundle.crtto the end ofcertificate.crt, then combine it with the private key generated by the program to complete assembling your full certificate.
Notes:
- One account can only issue one wildcard certificate. Register multiple accounts if you need certificates for multiple domains.
- It is strongly recommended to run ./zerossl.exe from cmd, do not double-click the executable directly. This prevents the program from exiting unexpectedly before you can save your private key.
How it works:
The approach is similar to the paid membership exploitation tricks that were popular years ago: you submit a paid subscription then immediately cancel it, and submit your certificate request before the system processes the cancellation.
Screenshot:
