acmetool(8)

📦

version 0.2.2 · 3 versions

0.2.2 · debian bookworm, debian trixie, ubuntu noble, ubuntu resolute, ubuntu stonking (latest)
0.2.1 · ubuntu jammy
0.2.2 · ubuntu noble

, in debian bookworm, debian trixie, ubuntu noble, ubuntu resolute, ubuntu stonking

💖 acmetool 💖 (System Manager's Manual, section 8)

okay bestie, listen — you know that one tool in the System Manager's Manual called acmetool? Yeah. This is her. She lives in section 8, she's a whole queen, and she's about to get you certificates. Sit down, hydrate, let's go 🫶

✨ NAME ✨

acmetool — request certificates from ACME servers automatically 🎀

✨ SYNOPSIS ✨

acmetool [<flags>] <command> [<args> ...]

like. that's the whole shape of it. flags, a command, args. iconic.

🌸 DESCRIPTION 🌸

acmetool is a utility for the automated retrieval, management and renewal of certificates from ACME server such as Let's Encrypt. she is obsessed with automation, idempotency, and the minimisation of state — like, she does not want to keep a bunch of stuff around, she is unbothered, moisturized, in her lane ✨

so how do you even use her? you configure targets — typically with the want command, that's the vibe. then acmetool requests certificates as necessary to satisfy the configured targets. new certificates get requested wherever the existing ones are soon to expire. no cap. she just handles it 💅

she stores her state in a state directory. you can specify it on invocation via the --state option; otherwise, the path in ACME_STATE_DIR is used, or, failing that, the path /var/lib/acme (recommended 🥇).

the --xlog options control the logging. the --service options control privilege dropping and daemonization — and those are applicable only to the redirector subcommand. like, only her. iykyk.

💅 OPTIONS 💅

okay this is the long part bestie, but every single one matters, so we're doing all of them, no skips, no shortcuts 🔥

--help — Show context-sensitive help (also try --help-long and --help-man). yes, there's three of them. she's thorough.
--state=/var/lib/acme — Path to the state directory (env: ACME_STATE_DIR)
--hooks=/etc/acme/hooks — Path to the notification hooks directory (env: ACME_HOOKS_DIR)
--batch — Do not attempt interaction; useful for cron jobs. (acmetool can still obtain responses from a response file, if one was provided.) so like, she'll shut up and just work 🫡
--stdio — Don't attempt to use console dialogs; fall back to stdio prompts
--response-file=RESPONSE-FILE — Read dialog responses from the given file (default: $ACME_STATE_DIR/conf/responses)
--version — Print version information
--xlog.facility=daemon — Syslog facility to use
--xlog.syslog — Log to syslog?
--xlog.syslogseverity=DEBUG — Syslog severity limit
--xlog.journal — Log to systemd journal?
--xlog.journalseverity=DEBUG — Systemd journal severity limit
--xlog.severity=NOTICE — Log severity (any syslog severity name or number)
--xlog.file="" — Log to filename
--xlog.fileseverity=TRACE — File logging severity limit
--xlog.stderr — Log to stderr?
--xlog.stderrseverity=TRACE — stderr logging severity limit
--service.cpuprofile="" — Write CPU profile to file
--service.debugserveraddr="" — Address for debug server to listen on (do not specify a public address) (default: disabled) 🚨 like seriously bestie, not a public one
--service.uid="" — UID to run as (default: don't drop privileges)
--service.gid="" — GID to run as (default: don't drop privileges)
--service.daemon — Run as daemon? (doesn't fork)
--service.stderr — Keep stderr open when daemonizing
--service.chroot="" — Chroot to a directory (must set UID, GID) ("/" disables) 🔒
--service.pidfile="" — Write PID to file with given filename and hold a write lock
--service.fork — Fork? (implies -daemon)

🦋 SUBCOMMANDS 🦋

the main character energy lives here. pick your girl 🌈

help `[<command>...]`

Show help.

reconcile `[<target-filenames>...]`

Reconcile ACME state, idempotently requesting and renewing certificates to satisfy configured targets.

this is the default command, so if you just run acmetool with nothing else, this is what you get. she's the default for a reason 💖

cull `[<flags>]`

Delete expired, unused certificates 🗑️

-n, --simulate — Show which certificates would be deleted without deleting any — like a little dress rehearsal, no actual deleting, we're just looking 👀

status

Show active configuration

want `[<flags>]` `<hostname>...`

Add a target with one or more hostnames

--reconcile — Specify --no-reconcile to skip reconcile after adding target

unwant `<hostname>...`

Modify targets to remove any mentions of the given hostnames — the reverse of want, she's letting go 🍃

quickstart `[<flags>]`

Interactively ask some getting started questions (recommended ✨)

--expert — Ask more questions in quickstart wizard — for the girlies who want the full interrogation 💅

redirector `[<flags>]`

HTTP to HTTPS redirector with challenge response support

--path=PATH — Path to serve challenge files from
--challenge-gid=CHALLENGE-GID — GID to chgrp the challenge path to (optional)
--read-timeout=10s — Maximum duration before timing out read of the request (default: '10s')
--write-timeout=20s — Maximum duration before timing out write of the request (default: '20s')
--status-code=308 — HTTP status code to use when redirecting (default '308')
--bind=":80" — Bind address for redirectory (default ':80')

remember: the --service options up in OPTIONS? they're applicable only to this subcommand. just her. 💅

test-notify `[<hostname>...]`

Test-execute notification hooks as though given hostnames were updated

import-jwk-account `<provider-url>` `<private-key-file>`

Import a JWK account key

import-pem-account `<provider-url>` `<private-key-file>`

Import a PEM account key

import-key `<private-key-file>`

Import a certificate private key 🔑

import-le `[<le-state-path*>]`

Import a Let's Encrypt client state directory

revoke `[<certificate-id-or-path>]`

Revoke a certificate — it's giving closure 💀

account-thumbprint

Prints account thumbprints

account-url

Show account URL

👑 AUTHOR 👑

periodt. that's the author, that's the copyright, that's the license, all of it, untouched 💜

🌈 SEE ALSO 🌈

Documentation: <https://github.com/hlandau/acmetool>

Report bugs at: <https://github.com/hlandau/acmetool/issues>

and that's the whole page, bestie 🎀 this was acmetool(8) — straight out of the System Manager's Manual, source/version acmetool, and yeah she's got no date on the footer because she's timeless ✨ go get those certificates. slay. 💖

📦 where this page comes from

debian bookworm: acmetool 0.2.2-1+b4 · MIT
debian trixie: acmetool 0.2.2-3+b1 · MIT
ubuntu noble: acmetool 0.2.2-2 · MIT
ubuntu resolute: acmetool 0.2.2-3 · MIT
ubuntu stonking: acmetool 0.2.2-3 · MIT
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms

acmetool(8)

💖 acmetool 💖 (System Manager's Manual, section 8)

✨ NAME ✨

✨ SYNOPSIS ✨

🌸 DESCRIPTION 🌸

💅 OPTIONS 💅

🦋 SUBCOMMANDS 🦋

help [<command>...]

reconcile [<target-filenames>...]

cull [<flags>]

status

want [<flags>] <hostname>...

unwant <hostname>...

quickstart [<flags>]

redirector [<flags>]

test-notify [<hostname>...]

import-jwk-account <provider-url> <private-key-file>

import-pem-account <provider-url> <private-key-file>

import-key <private-key-file>

import-le [<le-state-path*>]

revoke [<certificate-id-or-path>]