It's not European, rather a New Zealand company but I find https://zonomi.com/ pretty good. There's a Lego resolver that works fine https://github.com/go-acme/lego - although my only complaint is the DNS propagation takes a while though I suspect that's a my config problem (dig will show the txt record long before Lego sees it)
In The bootstrapper's EU stack for under €10 per monthgo-acme
lego
Go2015–2026
go-acme / lego
lego
Let's Encrypt/ACME client and library written in Go
38Distinct people
48Mentions
1Explicit recommenders
10KGitHub stars
What to know before exploring
What it is
Let's Encrypt/ACME client and library written in Go
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Just wanted to jump on this for Caddy users [1]: > Until further notice, when starting Caddy, we recommend using the '-disable-tls-sni-challenge' flag. This will require either…
mholt used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- certbot/certbot · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year48 dated mentions
Observed mentions: 2015-10-20 04:08:53 UTC to 2026-05-25 19:29:15 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 15 | 0 | 15 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 3 | 1 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Automatic Certificates and HTTPS for everyone.
Lego
ACME client and library for Let's Encrypt and other ACME CAs written in Go.
lego is an independent, free, and open-source project, if you value it, consider supporting it! ❤️
Everybody thinks that the others will donate, but in the end, nobody does.
So if you think that lego is worth it, please consider donating.
Features
ACME v2 RFC 8555
Support RFC 8737: TLS Application‑Layer Protocol Negotiation (ALPN) Challenge Extension
Support RFC 8738: certificates for IP addresses
Support RFC 9773: Renewal Information (ARI) Extension
Support draft-ietf-acme-profiles-00: Profiles Extension
Support draft-ietf-acme-dns-persist-01: Challenge for Persistent DNS TXT Record Validation
Comes with more than 200 DNS providers
Register with CA
Obtain certificates, both from scratch or with an existing CSR
Renew certificates
Revoke certificates
Robust implementation of ACME challenges:
HTTP (http-01)
DNS (dns-01)
TLS (tls-alpn-01)
SAN certificate support
CNAME support by default
Custom challenge solvers
Certificate bundling
OCSP helper function
Installation
How to install.
Usage
as a CLI
as a library
Documentation
Documentation is hosted live at https://go-acme.github.io/lego/.
DNS providers
Detailed documentation is available here.
If your DNS provider is not supported, please open an issue.
1cloud.ru
35.com/三五互联
51DNS
Abion
Active24
Akamai EdgeDNS
Alibaba Cloud DNS
AlibabaCloud ESA
all-inkl
Alwaysdata
Amazon Lightsail
Amazon Route 53
Anexia CloudDNS
ANS SafeDNS
ArtFiles
ArvanCloud
Aurora DNS
Autodns
Axelname
Azion
Azure DNS
Baidu Cloud
Beget.com
Binary Lane
Bindman
Bluecat
Bluecat v2
BookMyName
Bunny
Checkdomain
Civo
Cloud.ru
CloudDNS
Cloudflare
ClouDNS
CloudPress
Com Laude
Connbyte
ConoHa v2
ConoHa v3
Constellix
Core-Networks
CPanel/WHM
Curanet
Czechia
DanDomain
DDnss (DynDNS Service)
Derak Cloud
deSEC.io
Designate DNSaaS for Openstack
Digital Ocean
Dinahosting
DirectAdmin
DNS Made Easy
DNS Update (RFC2136)
dns.la
DNS.services
DNScale
DNSExit
dnsHome.de
DNSimple
DNSMint
Domain Offensive (do.de)
Domeneshop
DreamHost
Duck DNS
Dyn
Dynadot
DynDnsFree.de
Dynu
EasyDNS
EdgeCenter
Efficient IP
Epik
EuroDNS
EUserv
Excedo
Exoscale
External program
F5 XC
FENO
Fornex
freemyip.com
FusionLayer NameSurfer
G-Core
Gandi
Gandi Live DNS (v5)
Gehirn
Gigahost.no
Glesys
Gname
Go Daddy (DEPRECATED)
Go Daddy (v3)
Google Cloud
Gravity
Hetzner
Hosting.de
Hosting.nl
Hostinger
Hosttech
HostUp
HTTP request
http.net
Huawei Cloud
Hurricane Electric DNS
HyperOne
IBM Cloud (SoftLayer)
IIJ DNS Platform Service
Infoblox
Infomaniak
Internet.bs
INWX
Ionos
Ionos Cloud
IPv64
ISPConfig 3
ISPConfig 3 - Dynamic DNS (DDNS) Module
JD Cloud
Joker
Joohoi's ACME-DNS
Katapult
KeyHelp
Leaseweb
Liara
Lima-City
Linode (v4)
Liquid Web
Loopia
LuaDNS
Mail-in-a-Box
ManageEngine CloudDNS
Manual
Metaname
Metaregistrar
mijn.host
Mittwald
myaddr.{tools,dev,io}
MyDNS.jp
Myra
MythicBeasts
Name.com
Namecheap
Namesilo
NearlyFreeSpeech.NET
NederHost
Neodigit
Netcup (Legacy API)
Netcup v1
Netlify
Netnod
NexDNS
Ngenix
Nicmanager
NIFCloud
Njalla
Nodion
NordName
NS1
Octenium
omg.lol
Online.net
Open Telekom Cloud
Openprovider
OpusDNS
Oracle Cloud
OVH
plesk.com
PointDNS/PointHQ
Porkbun
Poweradmin
PowerDNS
PrimeDNS
Rackspace
Rage4
Rain Yun/雨云
RcodeZero
reg.ru
Regfish
RimuHosting
RU CENTER
Sakura Cloud
Scaleway
ScanNet
Selectel
Selectel v2
SelfHost.(de|eu)
SelfHost.(de|eu) (DEPRECATED)
Servercow
Shellrent
Simply.com
Sonic
Spaceship
Stackpath (Deprecated)
Syse
Technitium
Tele3
Tencent Cloud DNS
Tencent EdgeOne
Timeweb Cloud
TodayNIC/时代互联
TransIP
UCloud
Ultradns
United-Domains
Variomedia
Veesp
VegaDNS
Vercel
Versio.[nl|eu|uk]
VinylDNS
Virtualname
VK Cloud
Volcano Engine/火山引擎
Vscale
Vultr
Wannafind
Webglobe
webnames.ca
webnames.ru
Websupport
WEDOS
West.cn/西部数码
Xinnet
Yandex 360
Yandex Cloud
Yandex PDD
Zilore
Zone.ee
ZoneEdit
Zonomi
If your DNS provider is not supported, please open an issue.
Read the full README on GitHubWhat Hacker News says
48 sourcesNeat, I've used lego (https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client.
acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.
In You can run a DNS server (2025)lego: Let's Encrypt/ACME client and library written in Go
7 points · Open discussionI use https://github.com/go-acme/lego and DNS validation. I'm not sure what DNS provider you're using, but a ton of them have robust APIs. In my case, I'm using Route53 which is notable in that I can generate API credentials that can only update the specific record needed for a particular name's ACME validation record.
Here's a list of supported providers: https://go-acme.github.io/lego/dns/
And in case you're curious, the API perms dance to do specific-record updates: https://github.com/armorfret/terraform-aws-r53-certbot/blob/...
In WireGuard topologies for self-hosting at homeI don't understand the tone of aggression against ACME and their plethora of clients.
I know it isn't a skill issue because of who the author is. So I can only imagine it is some sort of personal opinion that they dislike ACME as a concept or the tooling around ACME in general.
We've been using LE for a while (since 2019 I think) for handful of sites, and the best nonsense client _for us_ was https://github.com/do-know/Crypt-LE/releases.
Then this year we've done another piece of work this time against the Sectigo ACME server and le64 wasn't quite good enough.
So we ended up trying:-
- https://github.com/certbot/certbot on GitHub Actions, it was fine but didn't quite like the locked down environment
- https://github.com/go-acme/lego huge binary, cli was interestingly designed and the maintainer was quite rude when raising an issue
- https
Read the rest
://github.com/rmbolger/Posh-ACME our favourite, but we ended up going with certbot on GHA once we fixed the weird issues around permissions
Edit* Re-read it. The tone isn't aimed at the ACME or the clients. It's the spec itself. ACME idea good, ACME implementation bad.
This is one area where I've found nixos to be really helpful. I can set this up with just adding some lines to the configuration.nix (which uses lego(1) and letsencrypt in the backend):
security.acme = {
acceptTerms = true;
defaults.email = "admin-email@provider.net";
certs."mydomain.example.com" = {
domain = "*.mydomain.example.com";
dnsProvider = "cloudflare";
environmentFile = "/path/to/cloudflare/password";
};
};
services.caddy.enable = true;
services.caddy.virtualHosts."subdomain1.mydomain.example.com" = {
extraConfig = ''
reverse_proxy 127.0.0.1:1234
'';
useACMEHost = "mydomain.example.com";
};
Configuring with nginx is also fairly similar I think.
1. https://github.com/go-acme/lego
In Take a look at Traefik, even if you don't use containersI would not trust that script.
If Python is such a hassle then there is also Lego: https://github.com/go-acme/lego which supports tons of DNS providers and is very well documented.
In Dehydrated: Letsencrypt/acme client implemented as a shell-scriptStatic binary, sure, but hardly a tiny supply chain attack surface: https://github.com/go-acme/lego/blob/master/go.sum
Also their official builds are built with Alpine which is a hobby distro that does not even do signed code or packages.
In Dehydrated: Letsencrypt/acme client implemented as a shell-scriptWith that rationale, why not use https://github.com/go-acme/lego which is a self contained lets encrypt client in Go?
In Dehydrated: Letsencrypt/acme client implemented as a shell-scriptI'd recommend learning how to instrument and measure the performance of your code. I find most performance issues are (mostly) situations you didn't and couldn't anticipate. So instead of preventing them, learning to investigate and fix them is key. (Shout out to Brendan and his Linux Performance page https://www.brendangregg.com/linuxperf.html).
Second there is an important engineering lesson to learn. Often there are many performance issues, with only a few acting as serious bottlenecks. Additionally sometimes the solutions to performance issues add complexity, but as an engineer you want to avoid complexity. Engineering effort is usually limited, so there is always a question of whether a performance issue needs to be fixed now or left till later.
Here is a quick example to illustrate my point. pgAdmin is a webui program to interact wi
Read the rest
th PostgreSQL databases, allowing you to remotely run queries. Part of its operations fetches information about columns in a result set, in one version this code ran one query per column sequentially. So c columns, each a synchronous query to the server - almost instant on a local database with a small number of columns. However with 400 columns, and a 40ms internet link, it ended up taking at least 400*40=16 seconds to complete. In 99% of cases this code works just fine, but in a few less obvious scenarios its runtime balloons.
Another example; what happens if all the daily scheduled jobs run at the same time? https://github.com/go-acme/lego/issues/1656
This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego
In Running one’s own root Certificate Authority in 2023Haven't used this myself, but I did find out about Lego (https://github.com/go-acme/lego) recently and used it to get a Let's Encrypt cert for a local network website I have using the DNS challenge. It was fairly straight forward,
$ export NAMESILO_API_KEY=...
$ export NAMESILO_POLLING_INTERVAL=10
$ export NAMESILO_PROPAGATION_TIMEOUT=1800
$ export NAMESILO_TTL=3600
$ lego --email <email> --dns namesilo --domains *.<domain>.com run
In Easy HTTPS for your private networksYeah, lego-acme is a solid alternative.
https://github.com/go-acme/lego
In Acme.sh runs arbitrary commands from a remote serverSuper easy with the right DNS provider and something like go-acme/Lego. Add a crom job and done. Yeah, not zero effort but compared to early Let's Encrypt with HTTP-01 and such it's quote easy.
https://github.com/go-acme/lego
In Self hosting in 2023I too am moving away from acme.sh for the same reason. Dehydrated looks nice but I started using goacme.
https://github.com/go-acme/lego
I wasn't set on only bash though.
In ZeroSSL: XSS to session hijacking, stealing a private key (and password hash)Showing the 15 most recent of 48 sources. Enable JavaScript to search and browse every indexed mention.