Everyone's recommending their favourite alternative. Mine is simp_le[1], a very simple ACME python client. It only supports the http challenge. You can run it w

Everyone's recommending their favourite alternative. Mine is simp_le[1], a very simple ACME python client. It only supports the http challenge. You can run it without root (I have a dedicated user generally), without stopping your webserver. You only need to allow write access to domain/.well-known/acme-challenge. Write a simple wrapper script and run it from cron. You get precisely the certificates needed for Apache or nginx. All that's left is to symlink them to the right spot. Let's Encrypt follows all redirects and ignores expired certificates so if you have multiple domains redirecting to one, you can get a certificate for all of them in one go even if your certificate expired. You can create a SAN certificate or multiple certificates in whatever constellation you like. SSL bliss. [1] https://github.com/kuba/simp_le https://github.com/kuba/simp_le