diff --git a/pkgs/tools/admin/acme.sh/default.nix b/pkgs/tools/admin/acme.sh/default.nix
new file mode 100644
index 00000000000..00d8bdd3ef4
--- /dev/null
+++ b/pkgs/tools/admin/acme.sh/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper, curl, openssl, socat, iproute }:
+stdenv.mkDerivation rec {
+  name = "acme.sh-${version}";
+  version = "2.7.8";
+
+  src = fetchFromGitHub {
+    owner = "Neilpang";
+    repo = "acme.sh";
+    rev = version;
+    sha256 = "0zm64z7av63xi7yjhljab2i8q1vx4q1mpcmcm58jm6k4babalxrf";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out $out/bin $out/libexec
+    cp -R $src/* $_
+    makeWrapper $out/libexec/acme.sh $out/bin/acme.sh \
+      --prefix PATH : "${lib.makeBinPath [ socat openssl curl iproute ]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A pure Unix shell script implementing ACME client protocol";
+    homepage = https://acme.sh/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.yorickvp ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2f1dd74b498..998176cd089 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -414,6 +414,8 @@ with pkgs;
 
   acct = callPackage ../tools/system/acct { };
 
+  acme-sh = callPackage ../tools/admin/acme.sh { };
+
   acoustidFingerprinter = callPackage ../tools/audio/acoustid-fingerprinter {
     ffmpeg = ffmpeg_1;
   };