Hacker News new | ask | show | jobs
by adiabatichottub 93 days ago
I'm a fan of uACME:

https://github.com/ndilieto/uacme

Tiny, simple, reliable. What more can you ask?

4 comments

I ended up vibe an ACME client for my custom TLS server.

It's a chat server but with curl. You can try it here

curl -NT. https://chat.est.im/hackernews

(Note: IPv6 only for the moment)

Neat, I've used lego (https://github.com/go-acme/lego) but will certainly have to give uacme a look, love me a simple ACME client.

acme.sh was too garish for my liking, even as a guy that likes his fair share of shell scripts. And obviously certbot is a non-starter because of snap.

Certbot has earned my ire on just about every occasion I've had to interact with it. It is a terrible program and I can't wait to finish replacing it everywhere.

The new setup is using uAcme and nsupdate to do DNS-01 challenges. No more fiddling with any issues in the web server config for a particular virtual host, like some errant rewrite rule that prevents access to .well-known/.

I mean certbot handles the just issue me a cert via DNS-01 and I'll do the rest flow just fine. Massive overkill of a program for just that use-case but it's been humming along for me for years at this point. What's the selling point for uACME?
Lego is solid. I use it with Route53 to do automatic renewal of LE certs for various endpoints before the certs expire.
> don't expect it to automatically set up your webserver to use the certificates it obtains.

This makes me so happy. Acme and certbot trying to do this is annoying, Caddy trying to get certs by default is annoying. I ended up on a mix of dehydrated and Apache mod_md but I think I like the look of uACME because dehydrated just feels clunky

Devops here. It's not only simple, it's rock solid. It puts all other ACME clients to shame.