Skip to main content

A Simple Method for Obtaining a Let's Encrypt SSL Certificate

I finally decided to update a few sites to use Let's Encrypt (LE) for SSL certificates. These are my notes about using a nuts-and-bolts / low-level method of doing this that doesn't involve automation.

At it's heart, Let's Encrypt uses the ACME protocol to verify domain ownership and certificate generation. LE lists many ACME client implementations here: The LE site recommends using certbot ( for the task.

However, for me, there was a little too much magic going on -- at least for my initial use -- I wanted to understand exactly what was taking place. I wanted to find an approach that:

  • Did not require use of a web interface.
  • Did not hide any steps in the process.
  • Supported a form of domain ownership verification that did not require email (i.e., verification via possession of prior key, DNS, or HTTP, was supported).

I decided to use Google's tool, acme, which strangely isn't mentioned on the EFF site. You can get it here: These are my notes about using Google's acme client.


The steps necessary to obtain and test a LE certificate manually can be performed on any machine on which acme and openssl are present.

  • Create a private certificate key for the user

    $ mkdir -p ~/.config/acme
    $ openssl genrsa -out ~/.config/acme/account.key 2048
  • Register the user's account with LE

    $ acme reg -gen -accept
  • Generate a private key for your certificate (optional)

    By default, acme, will create a private certificate using the ECDSA algorithm, however, this format is not supported by the Amazon AWS API Gateway. Therefore, we'll take the extra step of creating a 2048 bit RSA key, which AWS does support. $CERTSDIR is an arbitrary directory in which you with to place the credentials.

    $ cd $CERTSDIR
    $ openssl genrsa -out 2048
  • Request a new certificate for your domain

    $ cd $CERTSDIR
    $ acme cert -k -dns=true

    This will prompt you to create a DNS TXT record for with a specified value. Create the record and wait for it to propagate. After propagation, press enter and the new LE issued certificate will be downloaded to A URL will also be provided from which it can be downloaded. will contain both the private certificate for as well as the LE Intermediate Certificate. The site's certificate is the first entity in the file; the intermediate certificate is the second. I saved the certificates in and intermediate.crt, respectively.

  • Verify the certificate

    Before installing the certificates, I wanted to ensure they were working.
    The following link had a useful tip on verification:

    • Start an openssl SSL server for testing:

      $ openssl s_server -accept 8080 -www -cert \
                -key -CAfile intermediate.crt
    • Start an openssl client:

      $ openssl s_client -connect localhost:8080 -showcerts \
                -CAfile intermediate.crt

    The client output will tell you if the certificates are valid or if there are problems.


I did not conduct an exhaustive search, but I didn't find any Acme clients that support providing the existing private key as proof of ownership.