TACD(8)

🎀 NAME 🎀

tacd — TLS-ALPN Challenge Daemon. This is the TACD(8) page from the System Manager's Manual, and yes bestie, the manual name is literally folded right in here. 💖

💻 SYNOPSIS 💻

tacd [-e|--acme-ext STRING] [--acme-ext-file FILE] [--crt-digest STRING]
     [--crt-signature-alg STRING] [-d|--domain STRING]
     [--domain-file STRING] [-f|--foreground] [-h|--help]
     [-l|--listen host:port] [--log-stderr] [--log-syslog]
     [--log-level LEVEL] [--no-pid-file] [--pid-file FILE]
     [-V|--version]

Tiny heads-up, bestie: the synopsis above shows -l|--listen, and the options list below shows -i, --listen. I'm keeping both exactly as the page gives them — no merging, no fixing, no cap. 💅

✨ DESCRIPTION ✨

Okay so tacd is a server that listens for incoming Transport Layer Security (TLS) connections. If the acme-tls/1 protocol has been declared during the Application-Layer Protocol Negotiation (ALPN), it presents a self-signed certificate in order to attempt to solve the TLS-ALPN-01 challenge. Then it drops the connection. Iconic, honestly. 😌

In order to generate the self-signed certificate, you need to specify both the domain name to validate and the acmeIdentifier extension. If one of those values is not specified using the available options, it is read from the standard input. When reading from the standard input, a new line character is expected at the end. In the case both values need to be read from the standard input, the domain name is read first, then the acmeIdentifier extension. Order matters, bestie — don't switch them. 🫶

The options are as follows:

🛠️ OPTIONS 🛠️

• -e, --acme-ext STRING — the acmeIdentifier extension to set in the self-signed certificate. ✨
• --acme-ext-file FILE — file from which the acmeIdentifier extension to set in the self-signed certificate is read. 📄
• --crt-digest STRING — set the certificate's digest algorithm. Possible values are:
  • sha256
  • sha384
  • sha512
• --crt-signature-alg STRING — set the certificate's signature algorithm. Possible values depend on the cryptographic library support and can be listed using the --help flag. 🔐
• -d, --domain STRING — the domain that is being validated. 🌐
• --domain-file STRING — file from which the domain that is being validated is read. 📂
• -f, --foreground — runs in the foreground. 🏃‍♀️
• -h, --help — prints help information. 🙋‍♀️
• -i, --listen host:port | unix:path — specifies the host and port combination or the unix socket to listen on. 🎧
• --log-stderr — prints log messages to the standard error output. 🖨️
• --log-syslog — sends log messages via syslog. 📨
• --log-level LEVEL — specify the log level. Possible values: error, warn, info, debug and trace. 🪵
• --no-pid-file — do not create any PID file. 🚫
• --pid-file FILE — specifies the location of the PID file. 📍
• -V, --version — prints version information. 🏷️

👀 SEE ALSO 👀

Go check out acmed.toml(5) too — that's the whole SEE ALSO section, bestie. 🦋

📜 STANDARDS 📜

R.B. Shoemaker, Automated Certificate Management Environment (ACME) TLS Application-Layer Protocol Negotiation (ALPN) Challenge Extension, RFC 8737, February 2020. 📚

💖 AUTHORS 💖

Rodolphe Bréard ⟨rodolphe@breard.tf⟩ — author royalty, periodt. 👑

Source/version: Debian · Date: Mar 17, 2025 · Manual page: TACD(8) — that's the footer sign-off, bestie, mwah 💋