ACME-CLIENT(1)

🦋 acme-client(1) — okay so this is the General Commands Manual, bestie 🦋

✨ NAME ✨

acme-client — the ACME client, aka your little certificate-getting bestie 💅

---

🌸 SYNOPSIS 🌸

acme-client [-Fnrv] [-f configfile] handle

---

💖 DESCRIPTION 💖

acme-client is an Automatic Certificate Management Environment (ACME) client. It's giving "I go look in my config for a domain section that matches the handle you handed me on the command line, and then I use that config to go get you an X.509 certificate." And what's that certificate for? Domain name validation, babe — literally proving the domain is who it says it is 🫶. These certificates usually do the HTTPS thing for web servers, but honestly they can show up anywhere you need domain name validation (mail servers, we see you 👀).

So here's the vibe check on renewal: if the certificate already exists and it's getting close to expiry, acme-client tries to renew it. For certs with a lifetime of more than 10 days, it renews when less than a third of the lifetime remains ⏳. Otherwise, renewal happens when half the lifetime has expired. Math but make it ✨certificate management✨.

Now, to prove the client actually has access to the domain, the signing authority issues a challenge. acme-client implements the “http-01” challenge type — that's the one where a file gets created inside a directory that a locally run web server can reach. The default challenge directory is /var/www/acme, and you can serve it with httpd(8) using this location block, which will properly map response challenges (no cap, this exact block):

location "/.well-known/acme-challenge/*" {
        root "/acme"
        request strip 2
}

The options are as follows, bestie:

---

🎀 OPTIONS 🎀

• -F — Force certificate renewal, regardless of how much lifetime is left. No thinking, just renewing 🔥
• -f configfile — Specify an alternative configuration file. Use a different one than the default, go off 👑
• -n — No operation: it just checks and prints the configuration. A little vibe check, no changes made 🙈
• -r — Revoke the X.509 certificate. Bye bye certificate 💀
• -v — Verbose operation. Specify it twice to also trace communication and data transfers. Double -v = maximum yapping 🗣️
• handle — The handle of the domain section of the configuration that contains the details of the certificate to be created, renewed or revoked 🌈

---

🍓 FILES 🍓

• /etc/acme — Private keys for acme-client. Keep these safe, they're iconic but secret 🤫
• /etc/acme-client.conf — Default configuration.
• /var/www/acme — Default challengedir.

---

⭐ EXIT STATUS ⭐

acme-client returns 0 if certificates were changed (revoked or updated), 1 on failure, or 2 if the certificates didn't change (up to date). So like, 2 isn't a flop, it's just "we're already slaying" 💅

---

🧚 EXAMPLES 🧚

Example configuration files for acme-client and httpd(8) are provided in /etc/examples/acme-client.conf and /etc/examples/httpd.conf. Free templates, we love to see it 🎁

To generate a certificate for example.com and use it to provide HTTPS, create acme-client.conf and httpd.conf and run:

# acme-client -v example.com && rcctl reload httpd

A cron(8) job can renew the certificate as necessary. On renewal, httpd(8) is reloaded:

~ * * * * acme-client example.com && rcctl reload httpd

Set it and forget it, main character energy 👑

---

🔥 SEE ALSO 🔥

openssl(1), acme-client.conf(5), httpd.conf(5), ssl(8)

---

🌈 STANDARDS 🌈

R. Barnes, J. Hoffman-Andrews, D. McCarney, and J. Kasten, Automatic Certificate Management Environment (ACME), RFC 8555, March 2019.

---

💜 HISTORY 💜

The acme-client utility first appeared in OpenBSD 6.1. A whole era began ✨

---

🌸 AUTHORS 🌸

The acme-client utility was written by Kristaps Dzonsons <kristaps@bsd.lv>. Thank you legend 🫶

---

💀 CAVEATS 💀

Okay this part matters, bestie, listen up 👂 The usual ACME service providers are notoriously picky about authenticating rules, and yield fairly long time-outs after just a few invalid attempts. It is strongly suggested to first validate a configuration with a staging server before moving an official certificate validation workflow to crontab(5) status. Like, don't rawdog your production certs, test first, fr fr 😭

---

And that's the whole page, mwah 💋 — this beauty came from the Debian manual set, dated September 18, 2025. Go forth and get those certificates 🎀