To be clear on the facts, Let's Encrypt hasn't shut down ACMEv1 (yet). Accounts with domains which were already renewing via ACMEv1 can continue to do so, unti

To be clear on the facts, Let's Encrypt hasn't shut down ACMEv1 (yet). Accounts with domains which were already renewing via ACMEv1 can continue to do so, until June 2021. Only new domains are shut out. To me, seems fair enough. If you're booting up a new server, you may as well use a supported ACME client version. I do think that Let's Encrypt/EFF did make some big mistakes all those years ago on the ACME client side, though, which has directly translated to ongoing user suffering. Python was a not a good choice. Innumerable efforts have gone towards figuring out packaging issues purely caused by the choice of language. The CI alone is ridiculous. I don't understand why they didn't use something easier to package, like Go, which was sufficiently mature in 2014-2015 (well, duh, Boulder is written in Go). Certbot had to be available universally and needed to have a simple dependency and packaging story. Relying on external, volunteer distro package maintainers to figure out the rat's nest of Python and native dependencies required by Certbot without blowing up other packages is a problem too. God bless those volunteers, but those roles needed to be funded and given priority, because being unable to get a remotely recent (i.e. not years out of date) version or any of the DNS plugins is honestly one of the worst parts of using Certbot. Today's solution (Certbot snaps) isn't a panacea either. I somewhat suspect that Jaques' issues may have been avoided entirely if packaging had gone down a different route. I've contributed a bunch of patches to both Boulder and Certbot (and will continue to) but it's honestly a bit heartbreaking to see that the CA side do such a good job and the client is stuck in a revolving door of issues relating to their choice of programming language. That acme.sh is a fuckin' gigantic hacky shell script (this is a compliment Neil, I promise) and is, in many ways, superior to Certbot, is quite disappointing. This post isn't meant to dump on the past and current maintainers either. I have an abundance of empathy for them. I can see how many of the decisions would have been reasonable at the time, and how the evolution of the protocol seriously complicated things. I see only happier days for Certbot ahead and hope to be a part of that.