I use a shell script ACME client on FreeBSD (called letsencrypt.sh; different from the one linked in this submission and is available in FreeBSD's repos) and ha

I use a shell script ACME client on FreeBSD (called letsencrypt.sh; different from the one linked in this submission and is available in FreeBSD's repos) and have been for a couple of years now. It's worked flawlessly in that time and was an absolute doddle to use. In fact easier than the other ACME clients in FreeBSD's repos at that time. I do hear your criticism of shell scripting - I've written enough things in Bash and Bourne to be intimately familiar with the pitfalls myself. However the string handling required here is pretty basic (strings are encoded anyway as part of the ACME protocol so no escaping required there; and domain names are just ASCII characters without whitespace (even unicode domains just get compiled down to ASCII) so it's all pretty basic stuff). Plus curl and openssl are both solid tools and pretty standard on most systems (given openssl is used in the vast majority of web servers; you'd probably need that just to run your SSL certs anyway). I don't have anything against lego either. In fact I'm quite an advocate of Go - having written a number of projects in that language myself. But I do think this is one situation that shell scripts are a technically valid option as well.