3 ms·

If you like minimal dependencies another one to take a peek at may be acme.sh [1]. It depends on bash, openssl and curl. It seems to work fine in ash as well.

If you like minimal dependencies another one to take a peek at may be acme.sh [1]. It depends on bash, openssl and curl. It seems to work fine in ash as well. It has code to handle most API's and most importantly to me is the great documentation. In the same spirit of minimal and light weight there is also testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh https://github.com/drwetter/testssl.sh

encryptluks2 4y ago
I'd prefer to use a C, Go, or Rust app at this point. I love shell scripts because it was one of the first scripting languages I learned, but I'd trust a developer capable of writing C, Go or Rust to do a better job and make something more optimized than what is within the scope of Posix shell scripting.
- FpUser 4y ago
  To me it is a utility stuff. As long as it does the job (and acme.sh does it just fine) and does not require pulling down half of the Internet for dependencies I would not give rat's ass about what language has been used to write it.
- vladvasiliu 4y ago
  There's step-cli that's just a single go executable: https://github.com/smallstep/cli https://github.com/smallstep/cli They also provide a CA to go with it, if you need internal certs.
  - encryptluks2 4y ago
    Thanks. I actually have this installed. It does so many things and is pretty incredible!
- jamespo 4y ago
  I don't think optimization really matters to most people for a tool that does automated cert requests.
  - encryptluks2 4y ago
    It is to an extent. I'm not saying acme.sh is bad just that if there is a tool in Go, Rust or C that does the same thing and is more efficient then I'm picking something that isn't wrapped in a bunch of shell code. Same with tiny webservers.
- newman314 4y ago
  I use https://github.com/go-acme/lego https://github.com/go-acme/lego, single Go binary.
dividuum 4y ago
Personally, I'm a fan of https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny. 200 lines of python without any additional python requirements and only the openssl binary as external dependency.
- frutiger 4y ago
  I will plug my own Python program https://github.com/frutiger/concorde https://github.com/frutiger/concorde, which does depend on `requests` and `cryptography`.
- ori_b 4y ago
  If we're plugging implementations, I tend to use the single-file implementation that ships with 9front. I wrote the first cut, but it's been improved heavily by others: http://man.9front.org/8/acmed http://man.9front.org/8/acmed http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd/auth/acmed.c/f.html http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd... It works quite well, and if you mount your unix machines via sshfs, it's pretty easy to dump the certs into the right place with them. And unlike most ACME clients, it works seamlessly with DNS authentication, which allows you to easily grab wildcard certs.
- yonrg 4y ago
  This! Thanks for also mentioning it. So plain easy and just does what I need! Thanks to the author for publishing it. I maintain my own patch, so tiny-acme supports an '--outfile' option (it originally only writes to stdout). This comes in handy when it is run by systemd service/timer. The pull request is on hold, because the code then exceeds then 200 lines threshold :shrug:
  - Klasiaster 4y ago
    You can directly redirect the service's output to a file: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#StandardOutput= https://www.freedesktop.org/software/systemd/man/systemd.exe...
    - 4y ago

encryptluks2 4y ago

I'd prefer to use a C, Go, or Rust app at this point. I love shell scripts because it was one of the first scripting languages I learned, but I'd trust a developer capable of writing C, Go or Rust to do a better job and make something more optimized than what is within the scope of Posix shell scripting.

FpUser 4y ago
To me it is a utility stuff. As long as it does the job (and acme.sh does it just fine) and does not require pulling down half of the Internet for dependencies I would not give rat's ass about what language has been used to write it.
vladvasiliu 4y ago
There's step-cli that's just a single go executable: https://github.com/smallstep/cli https://github.com/smallstep/cli They also provide a CA to go with it, if you need internal certs.
- encryptluks2 4y ago
  Thanks. I actually have this installed. It does so many things and is pretty incredible!
jamespo 4y ago
I don't think optimization really matters to most people for a tool that does automated cert requests.
- encryptluks2 4y ago
  It is to an extent. I'm not saying acme.sh is bad just that if there is a tool in Go, Rust or C that does the same thing and is more efficient then I'm picking something that isn't wrapped in a bunch of shell code. Same with tiny webservers.
newman314 4y ago
I use https://github.com/go-acme/lego https://github.com/go-acme/lego, single Go binary.

dividuum 4y ago

Personally, I'm a fan of https://github.com/diafygi/acme-tiny https://github.com/diafygi/acme-tiny. 200 lines of python without any additional python requirements and only the openssl binary as external dependency.

frutiger 4y ago
I will plug my own Python program https://github.com/frutiger/concorde https://github.com/frutiger/concorde, which does depend on `requests` and `cryptography`.
ori_b 4y ago
If we're plugging implementations, I tend to use the single-file implementation that ships with 9front. I wrote the first cut, but it's been improved heavily by others: http://man.9front.org/8/acmed http://man.9front.org/8/acmed http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd/auth/acmed.c/f.html http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd... It works quite well, and if you mount your unix machines via sshfs, it's pretty easy to dump the certs into the right place with them. And unlike most ACME clients, it works seamlessly with DNS authentication, which allows you to easily grab wildcard certs.
yonrg 4y ago
This! Thanks for also mentioning it. So plain easy and just does what I need! Thanks to the author for publishing it. I maintain my own patch, so tiny-acme supports an '--outfile' option (it originally only writes to stdout). This comes in handy when it is run by systemd service/timer. The pull request is on hold, because the code then exceeds then 200 lines threshold :shrug:
- Klasiaster 4y ago
  You can directly redirect the service's output to a file: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#StandardOutput= https://www.freedesktop.org/software/systemd/man/systemd.exe...
  - 4y ago