If we're plugging implementations, I tend to use the single-file implementation that ships with 9front. I wrote the first cut, but it's been improved heavily by

If we're plugging implementations, I tend to use the single-file implementation that ships with 9front. I wrote the first cut, but it's been improved heavily by others: http://man.9front.org/8/acmed http://man.9front.org/8/acmed http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd/auth/acmed.c/f.html http://git.9front.org/plan9front/plan9front/HEAD/sys/src/cmd... It works quite well, and if you mount your unix machines via sshfs, it's pretty easy to dump the certs into the right place with them. And unlike most ACME clients, it works seamlessly with DNS authentication, which allows you to easily grab wildcard certs.