I'd prefer to use a C, Go, or Rust app at this point. I love shell scripts because it was one of the first scripting languages I learned, but I'd trust a developer capable of writing C, Go or Rust to do a better job and make something more optimized than what is within the scope of Posix shell scripting.

There's step-cli that's just a single go executable: https://github.com/smallstep/cli

They also provide a CA to go with it, if you need internal certs.

Thanks. I actually have this installed. It does so many things and is pretty incredible!

To me it is a utility stuff. As long as it does the job (and acme.sh does it just fine) and does not require pulling down half of the Internet for dependencies I would not give rat's ass about what language has been used to write it.

I don't think optimization really matters to most people for a tool that does automated cert requests.

It is to an extent. I'm not saying acme.sh is bad just that if there is a tool in Go, Rust or C that does the same thing and is more efficient then I'm picking something that isn't wrapped in a bunch of shell code. Same with tiny webservers.

I use https://github.com/go-acme/lego, single Go binary.

Personally, I'm a fan of https://github.com/diafygi/acme-tiny. 200 lines of python without any additional python requirements and only the openssl binary as external dependency.

If we're plugging implementations, I tend to use the single-file implementation that ships with 9front. I wrote the first cut, but it's been improved heavily by others:

http://man.9front.org/8/acmed

http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd...

It works quite well, and if you mount your unix machines via sshfs, it's pretty easy to dump the certs into the right place with them.

And unlike most ACME clients, it works seamlessly with DNS authentication, which allows you to easily grab wildcard certs.

This! Thanks for also mentioning it. So plain easy and just does what I need! Thanks to the author for publishing it.

I maintain my own patch, so tiny-acme supports an '--outfile' option (it originally only writes to stdout). This comes in handy when it is run by systemd service/timer.

The pull request is on hold, because the code then exceeds then 200 lines threshold :shrug:

You can directly redirect the service's output to a file: https://www.freedesktop.org/software/systemd/man/systemd.exe...

Thanks! That's tempting to drop the patch and just stay with the upstream.

I will plug my own Python program https://github.com/frutiger/concorde, which does depend on `requests` and `cryptography`.