4 ms·
I probably wouldn't trust implementing important network speaking services as a shell script, potentially running as root. OpenBSD's acme-client [0] is a fork
by brynet 9y ago
I probably wouldn't trust implementing important network speaking services as a shell script, potentially running as root.
OpenBSD's acme-client [0] is a fork of Kristaps Dzonsons' project (formerly letskencrypt), it's a properly privilege separated ACME v1 client, written in C, using pledge(2) on OpenBSD, libseccomp on Linux.
https://kristaps.bsd.lv/acme-client/ https://kristaps.bsd.lv/acme-client/
[0] https://man.openbsd.org/acme-client https://man.openbsd.org/acme-client
- Panino 9y agoacme-client is great and I use it for RSA certs, preferring it over acme-tiny [0]. However I prefer ECDSA (until we get EdDSA), so for those certs I use acme-tiny. https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny