>Any method of automatically renewing certificates, regardless of what script it used, is going to require the privileges needed to alter the certificate file.

>Any method of automatically renewing certificates, regardless of what script it used, is going to require the privileges needed to alter the certificate file. The only way to not run it as root would mean the certificate is editable by a non-root user. I don't want any script, no matter how open or free or vetted, to have the ability to alter the certificate on the server. The validation process can be customized or even carried out manually if you so insist. After all only requires a particular token to be available from a particular path under the domain to be signed, just drop the path to your token into your apache/nginx/god-forbid-IIS config file and you are good to go. The automated scripts was provided to make it easier for non-admin types of deploy; that said allowing these people to manage their own server sounds like a bad idea from the get-go.