FWIW, both of these issues are acme-tiny-specific quirks. The protocol allows clients to handle both intermediate certificate changes and ToS updates without any user interaction (and without breaking renewal). These things were not implemented in acme-tiny in order to keep the LOC count low from what I can tell.
I tend to recommend lego[1] to anyone needing a high-quality ACME client without certbot's complex auto-configuration features. Might be what you're looking for. It's written in go and can be installed by fetching a single binary.
[1]: https://github.com/xenolf/lego
In Let's Automate Let's Encryptgo-acme
lego
Go2015–2026
go-acme / lego
lego
Let's Encrypt/ACME client and library written in Go
38Distinct people
48Mentions
1Explicit recommenders
10KGitHub stars
What to know before exploring
What it is
Let's Encrypt/ACME client and library written in Go
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Just wanted to jump on this for Caddy users [1]: > Until further notice, when starting Caddy, we recommend using the '-disable-tls-sni-challenge' flag. This will require either…
mholt used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- certbot/certbot · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 6:01:32 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year48 dated mentions
Observed mentions: 2015-10-20 04:08:53 UTC to 2026-05-25 19:29:15 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 15 | 0 | 15 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 3 | 1 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Automatic Certificates and HTTPS for everyone.
Lego
ACME client and library for Let's Encrypt and other ACME CAs written in Go.
lego is an independent, free, and open-source project, if you value it, consider supporting it! ❤️
Everybody thinks that the others will donate, but in the end, nobody does.
So if you think that lego is worth it, please consider donating.
Features
ACME v2 RFC 8555
Support RFC 8737: TLS Application‑Layer Protocol Negotiation (ALPN) Challenge Extension
Support RFC 8738: certificates for IP addresses
Support RFC 9773: Renewal Information (ARI) Extension
Support draft-ietf-acme-profiles-00: Profiles Extension
Support draft-ietf-acme-dns-persist-01: Challenge for Persistent DNS TXT Record Validation
Comes with more than 200 DNS providers
Register with CA
Obtain certificates, both from scratch or with an existing CSR
Renew certificates
Revoke certificates
Robust implementation of ACME challenges:
HTTP (http-01)
DNS (dns-01)
TLS (tls-alpn-01)
SAN certificate support
CNAME support by default
Custom challenge solvers
Certificate bundling
OCSP helper function
Installation
How to install.
Usage
as a CLI
as a library
Documentation
Documentation is hosted live at https://go-acme.github.io/lego/.
DNS providers
Detailed documentation is available here.
If your DNS provider is not supported, please open an issue.
1cloud.ru
35.com/三五互联
51DNS
Abion
Active24
Akamai EdgeDNS
Alibaba Cloud DNS
AlibabaCloud ESA
all-inkl
Alwaysdata
Amazon Lightsail
Amazon Route 53
Anexia CloudDNS
ANS SafeDNS
ArtFiles
ArvanCloud
Aurora DNS
Autodns
Axelname
Azion
Azure DNS
Baidu Cloud
Beget.com
Binary Lane
Bindman
Bluecat
Bluecat v2
BookMyName
Bunny
Checkdomain
Civo
Cloud.ru
CloudDNS
Cloudflare
ClouDNS
CloudPress
Com Laude
Connbyte
ConoHa v2
ConoHa v3
Constellix
Core-Networks
CPanel/WHM
Curanet
Czechia
DanDomain
DDnss (DynDNS Service)
Derak Cloud
deSEC.io
Designate DNSaaS for Openstack
Digital Ocean
Dinahosting
DirectAdmin
DNS Made Easy
DNS Update (RFC2136)
dns.la
DNS.services
DNScale
DNSExit
dnsHome.de
DNSimple
DNSMint
Domain Offensive (do.de)
Domeneshop
DreamHost
Duck DNS
Dyn
Dynadot
DynDnsFree.de
Dynu
EasyDNS
EdgeCenter
Efficient IP
Epik
EuroDNS
EUserv
Excedo
Exoscale
External program
F5 XC
FENO
Fornex
freemyip.com
FusionLayer NameSurfer
G-Core
Gandi
Gandi Live DNS (v5)
Gehirn
Gigahost.no
Glesys
Gname
Go Daddy (DEPRECATED)
Go Daddy (v3)
Google Cloud
Gravity
Hetzner
Hosting.de
Hosting.nl
Hostinger
Hosttech
HostUp
HTTP request
http.net
Huawei Cloud
Hurricane Electric DNS
HyperOne
IBM Cloud (SoftLayer)
IIJ DNS Platform Service
Infoblox
Infomaniak
Internet.bs
INWX
Ionos
Ionos Cloud
IPv64
ISPConfig 3
ISPConfig 3 - Dynamic DNS (DDNS) Module
JD Cloud
Joker
Joohoi's ACME-DNS
Katapult
KeyHelp
Leaseweb
Liara
Lima-City
Linode (v4)
Liquid Web
Loopia
LuaDNS
Mail-in-a-Box
ManageEngine CloudDNS
Manual
Metaname
Metaregistrar
mijn.host
Mittwald
myaddr.{tools,dev,io}
MyDNS.jp
Myra
MythicBeasts
Name.com
Namecheap
Namesilo
NearlyFreeSpeech.NET
NederHost
Neodigit
Netcup (Legacy API)
Netcup v1
Netlify
Netnod
NexDNS
Ngenix
Nicmanager
NIFCloud
Njalla
Nodion
NordName
NS1
Octenium
omg.lol
Online.net
Open Telekom Cloud
Openprovider
OpusDNS
Oracle Cloud
OVH
plesk.com
PointDNS/PointHQ
Porkbun
Poweradmin
PowerDNS
PrimeDNS
Rackspace
Rage4
Rain Yun/雨云
RcodeZero
reg.ru
Regfish
RimuHosting
RU CENTER
Sakura Cloud
Scaleway
ScanNet
Selectel
Selectel v2
SelfHost.(de|eu)
SelfHost.(de|eu) (DEPRECATED)
Servercow
Shellrent
Simply.com
Sonic
Spaceship
Stackpath (Deprecated)
Syse
Technitium
Tele3
Tencent Cloud DNS
Tencent EdgeOne
Timeweb Cloud
TodayNIC/时代互联
TransIP
UCloud
Ultradns
United-Domains
Variomedia
Veesp
VegaDNS
Vercel
Versio.[nl|eu|uk]
VinylDNS
Virtualname
VK Cloud
Volcano Engine/火山引擎
Vscale
Vultr
Wannafind
Webglobe
webnames.ca
webnames.ru
Websupport
WEDOS
West.cn/西部数码
Xinnet
Yandex 360
Yandex Cloud
Yandex PDD
Zilore
Zone.ee
ZoneEdit
Zonomi
If your DNS provider is not supported, please open an issue.
Read the full README on GitHubWhat Hacker News says
15 sourcesCheck out Lego [0]. You can do DNS verification instead, no need to restart nginx :)
[0]: https://github.com/xenolf/lego
In What It Costs to Run Let's Encryptrsc's code is using /acme from https://github.com/xenolf/lego (same thing?)
In GoDoc: package letsencryptAlso see https://godoc.org/golang.org/x/crypto/acme and
https://github.com/xenolf/lego
Go has some of the best letsencrypt tooling out there, and there was even some support for merging ACME support directly into net/http
https://github.com/golang/go/issues/17053
In GoDoc: package letsencryptlego seems to have a plugin for Gandi's DNS API[1].
Let's Encrypt always sends DNS queries to the domain's authoritative DNS server and doesn't cache any results, so as soon as your authoritative DNS server has the record, you're good.
[1]: https://github.com/xenolf/lego/tree/master/providers/dns/gan...
In Let's Encrypt now fully supports IPv6Take a look at lego, it appears to support Vultr's DNS API[1] (and many others).
[1]: https://github.com/xenolf/lego/tree/master/providers/dns/vul...
In Let's Encrypt now fully supports IPv6Theoretically, you could make this work with any DNS provider with an API. Much the same way that lego does: https://github.com/xenolf/lego/tree/master/providers/dns
AFIACT you still have to configure the DNS A record yourself, kube-cert-manager just solves the challenges using DNS.
In Show HN: Kubernetes Certificate Manager – Native Let's Encrypt IntegrationHave you looked into https://github.com/xenolf/lego ? This project already have support for many DNS providers.
In Show HN: Kubernetes Certificate Manager – Native Let's Encrypt IntegrationLast time I tried this, I used Lego, which was very easy:
https://github.com/xenolf/lego
Does anyone know how long it will be since nginx gets native support for ACME, like Caddy has?
In How to use Let's Encrypt with multiple domains on Nginx on UbuntuThis new name and website are a big improvement to the branding of the client, and make it clear that this client is not a requirement for getting a certificate from Let's Encrypt. It was very difficult to explain to people learning about it that there is a difference between:
1. Let's Encrypt, the certificate authority
2. ACME, the protocol for users to interact with Let's Encrypt
3. Boulder, an implementation of an ACME server in Go that Let's Encrypt uses
4. Certbot (formerly the Let's Encrypt client), a command line client and ACME library for Python, originally developed by the Let's Encrypt team
Any CA can use ACME to offer automated certificate issuance to their users. Anyone can implement an ACME server or client in any language. There is no "official" client or server necessary.
It's also important that Certbot was rebranded to d
Read the rest
istance it from Let's Encrypt because, personally, I think the project is doomed to fail. It tries to handle both certificate issuance and configuration of software using certificates. It attempts to abstract the process for someone who barely understands what certificates/SSL/TLS are (if at all), but requires so much detail from them in order to configure and run the client that they might well have just learned how it worked in the first place. In other words, Certbot's use case targets laymen, but requires non-layman understanding to use. It doesn't help that their documentation is very badly organized and confusing, often mixing content for the CLI and the Python Library, which have different audiences: end users and developers building an automated tool in Python.
Meanwhile, intermediate and advanced developers and system administrators who understand the concepts are much better served by a different client that simply takes care of certificate issuance without trying to automatically manage the software they will be using the certificate with. There are many, but so far I've been happy with Lego (https://github.com/xenolf/lego).
I use the lego[1] client for DNS verification and it works pretty well so far (more deets[2]).
[1]: https://github.com/xenolf/lego
[2]: https://disjoint.ca/til/2016/03/26/lets-encrypt-tls-certific...
In Fully automated dockerized Let's Encrypt reverse proxyYou do not have to use their software.
You can use one of the alternate clients people have written, or write your own:
https://github.com/xenolf/lego
https://github.com/ericchiang/letsencrypt
Or use this web interface:
https://gethttpsforfree.com/
Also you can configure it to give you longer lasting certs.
In Geolocation API removed from unsecured origins in Chrome 50Yep, dns-01 went live in January. If your DNS server happens to support RFC 2136, take a look at lego[1] - some other provider-specific plugins for DNS are included as well.
[1]: https://github.com/xenolf/lego
In Why IRC over SSL is pointless (2009)I'm not sure if, conceptually, the term "official client" is still appropriate after the project is moved to the EFF and the rename is done. It's basically a move to ensure a vibrant client ecosystem which encourages users to pick the client that best fits their needs.
If you're looking for a Go client, lego[1] is awesome.
[1]: https://github.com/xenolf/lego
In Leaving Beta, New SponsorsTrue Go binaries like lego[1] are statically compiled (zero external dependencies). No need to fuss about versions of installed dependencies, updates, package management, etc. You just run the binary and it just works.
[1]: https://github.com/xenolf/lego
In Let's Encrypt has issued its first million certificates