$ git clone https://github.com/letsencrypt/letsencrypt
$ cd letsencrypt
$ ./letsencrypt-auto --help

$ ./letsencrypt-auto --help
Updating letsencrypt and virtual environment dependencies.......
Running with virtualenv: /root/.local/share/letsencrypt/bin/letsencrypt --help
letsencrypt [SUBCOMMAND] [options] [-d domain] [-d domain] …
The Let’s Encrypt agent can obtain and install HTTPS/TLS/SSL certificates.  By
default, it will attempt to use a webserver both for obtaining and installing
the cert. Major SUBCOMMANDS are:
(default) run        Obtain & install a cert in your current webserver
certonly             Obtain cert, but do not install it (aka “auth”)
install              Install a previously obtained cert in a server
revoke               Revoke a previously obtained certificate
rollback             Rollback server configuration changes made during install
config_changes       Show changes made to server config during installation
plugins              Display information about installed plugins
Choice of server plugins for obtaining and installing cert:
–apache          Use the Apache plugin for authentication & installation
–standalone      Run a standalone webserver for authentication
(nginx support is experimental, buggy, and not installed by default)
–webroot         Place files in a server’s webroot folder for authentication
OR use different plugins to obtain (authenticate) the cert and then install it:
–authenticator standalone –installer apache
More detailed help:
-h, –help [topic]    print this message, or detailed help on a topic;
the available topics are:
all, automation, paths, security, testing, or any of the subcommands or
plugins (certonly, install, nginx, apache, standalone, webroot, etc)

$ sudo ./letsencrypt-auto certonly \
    --webroot --webroot-path /var/www/htdocs/ \
    --email [email protected] \
    -d www.example.com

$ tree /etc/letsencrypt/
.
├── accounts
│   └── acme-v01.api.letsencrypt.org
│       └── directory
│           └── 69e7ae92b1a61252a6989403c95a10c8
│               ├── meta.json
│               ├── private_key.json
│               └── regr.json
├── archive
│   └── www.example.com
│       ├── cert1.pem
│       ├── cert2.pem
│       ├── cert3.pem
│       ├── chain1.pem
│       ├── chain2.pem
│       ├── chain3.pem
│       ├── fullchain1.pem
│       ├── fullchain2.pem
│       ├── fullchain3.pem
│       ├── privkey1.pem
│       ├── privkey2.pem
│       └── privkey3.pem
├── csr
│   ├── 0000_csr-letsencrypt.pem
│   ├── 0001_csr-letsencrypt.pem
│   ├── 0002_csr-letsencrypt.pem
│   └── 0003_csr-letsencrypt.pem
├── keys
│   ├── 0000_key-letsencrypt.pem
│   ├── 0001_key-letsencrypt.pem
│   ├── 0002_key-letsencrypt.pem
│   └── 0003_key-letsencrypt.pem
├── live
│   └── www.example.com
│       ├── cert.pem -> ../../archive/www.example.com/cert3.pem
│       ├── chain.pem -> ../../archive/www.example.com/chain3.pem
│       ├── fullchain.pem -> ../../archive/www.example.com/fullchain3.pem
│       └── privkey.pem -> ../../archive/www.example.com/privkey3.pem
└── renewal
    └── www.example.com.conf

$ sudo ./letsencrypt-auto certonly \
    --renew \
    --webroot --webroot-path /var/www/htdocs/ \
    --email [email protected] \
    -d www.example.com

# Get a copy of acme-tiny
$ cd /opt
$ git clone https://github.com/diafygi/acme-tiny.git
$ cd acme-tiny
$ python acme_tiny.py --help

$ python acme_tiny.py --help
usage: acme_tiny.py [-h] --account-key ACCOUNT_KEY --csr CSR --acme-dir
                    ACME_DIR [--quiet] [--ca CA]
This script automates the process of getting a signed TLS certificate from
Let’s Encrypt using the ACME protocol. It will need to be run on your server
and have access to your private account key, so PLEASE READ THROUGH IT! It’s
only ~200 lines, so it won’t take long.
===Example Usage===
python acme_tiny.py –account-key ./account.key –csr ./domain.csr –acme-dir /usr/share/nginx/html/.well-known/acme-challenge/ > signed.crt
===Example Crontab Renewal (once per month)===
0 0 1 * * python /path/to/acme_tiny.py –account-key /path/to/account.key –csr /path/to/domain.csr –acme-dir /usr/share/nginx/html/.well-known/acme-challenge/ > /path/to/signed.crt 2» /var/log/acme_tiny.log
optional arguments:
-h, –help            show this help message and exit
–account-key ACCOUNT_KEY
path to your Let’s Encrypt account private key
–csr CSR             path to your certificate signing request
–acme-dir ACME_DIR   path to the .well-known/acme-challenge/ directory
–quiet               suppress output except for errors
–ca CA               certificate authority, default is Let’s Encrypt

# Create a directory for the keys and cert
mkdir -p /etc/letsencrypt/www.example.com
cd /etc/letsencrypt/www.example.com

# Generate a private key
openssl genrsa 4096 > account.key

# Generate a domain private key (if you haven't already)
openssl genrsa 4096 > domain.key

# Create a CSR for www.example.com
openssl req -new -sha256 -key domain.key -subj "/CN=www.example.com" > domain.csr

# Create the challenge folder in the webroot
mkdir -p /var/www/htdocs/.well-known/acme-challenge/

# Get a signed certificate with acme-tiny
python /opt/acme-tiny/acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/htdocs/.well-known/acme-challenge/ > ./signed.crt

# Append the Let's Encrypt intermediate cert to your cert
wget -O - https://letsencrypt.org/certs/lets-encrypt-x1-cross-signed.pem > intermediate.pem
cat signed.crt intermediate.pem > chained.pem

# openssl genrsa 4096 > account.key
Generating RSA private key, 4096 bit long modulus
...................................................................................................................++
.........................................................................................................++
e is 65537 (0x10001)
# openssl genrsa 4096 > domain.key
Generating RSA private key, 4096 bit long modulus
........................................++
.........................................................................................................................................................................................................................................................................................................................................................................................++
e is 65537 (0x10001)
# openssl req -new -sha256 -key domain.key -subj "/CN=www.example.com" > domain.csr
# mkdir -p /var/www/htdocs/.well-known/acme-challenge/
# python /opt/acme-tiny/acme_tiny.py --account-key ./account.key --csr ./domain.csr --acme-dir /var/www/htdocs/.well-known/acme-challenge/ > ./signed.crt
Parsing account key...
Parsing CSR...
Registering account...
Already registered!
Verifying www.example.com...
www.example.com verified!
Signing certificate...
Certificate signed!

$ cd /opt
$ git clone https://github.com/kuba/simp_le
$ cd simp_le

# Setup dependencies and run
$ ./bootstrap.sh
$ ./venv.sh
$ ./venv/bin/simp_le --help

$ ./venv/bin/simp_le --help
Simple Let's Encrypt client.
-v, –verbose         Increase verbosity of the logging. (default: False)
-h, –help            Show this help message and exit.
–version             Display version and exit.
–revoke              Revoke existing certificate (default: False)
–test                Run tests and exit. (default: False)
Webroot manager:
This client is just a sophisticated manager for $webroot/.well-known/acme-
challenge. You can (optionally) specify --default_root, and override
per-vhost with -d example.com:/var/www/other_html syntax.
-d DOMAIN:PATH, –vhost DOMAIN:PATH
Domain name that will be included in the certificate.
Must be specified at least once. (default: None)
–default_root PATH   Default webroot path. (default: None)
Certificate data files:
-f PLUGIN             Input/output plugin of choice, can be specified
multiple times and, in fact, it should be specified as
many times as it is necessary to cover all components:
key, certificate, chain. Allowed values:
account_key.json, cert.der, cert.pem, chain.der,
chain.pem, external_pem.sh, fullchain.der,
fullchain.pem, key.der, key.pem. (default: [])
–cert_key_size BITS  Certificate key size. Fresh key is created for each
renewal. (default: 4096)
–valid_min SECONDS   Minimum validity of the resulting certificate.
(default: 2592000)
–reuse_key           Reuse private key if it was previously persisted.
(default: False)
Registration:
This client will automatically register an account with the ACME CA
specified by --server.
–account_key_public_exponent BITS
Account key public exponent value. (default: 65537)
–account_key_size BITS
Account key size in bits. (default: 4096)
–tos_sha256 HASH     SHA-256 hash of the contents of Terms Of Service URI
contents. (default: 33d233c8ab558ba6c8ebc370a509acdded
8b80e5d587aa5d192193f35226540f)
–email EMAIL         Email address. CA is likely to use it to remind about
expiring certificates, as well as for account
recovery. Therefore, it’s highly recommended to set
this value. (default: None)
HTTP:
Configure properties of HTTP requests and responses.
–user_agent NAME     User-Agent sent in all HTTP requests. Override with
–user_agent "" if you want to protect your privacy.
(default: simp_le/0)
–server URI          Directory URI for the CA ACME API endpoint. (default:
https://acme-v01.api.letsencrypt.org/directory)
See https://github.com/kuba/simp_le for more info.

$ ./venv/bin/simp_le \
    -f account_key.json -f key.pem -f cert.pem -f fullchain.pem \
    --email [email protected] \
    -d www.example.com:/var/www/htdocs/

$ cd /opt
$ git clone https://github.com/diafygi/letsencrypt-nosudo
$ cd letsencrypt-nosudo
$ python sign_csr.py -h

$ python sign_csr.py -h
usage: sign_csr.py [-h] -p PUBLIC_KEY [-e EMAIL] [-f] csr_path
Get a SSL certificate signed by a Let’s Encrypt (ACME) certificate authority and
output that signed certificate. You do NOT need to run this script on your
server and this script does not ask for your private keys. It will print out
commands that you need to run with your private key or on your server as root,
which gives you a chance to review the commands instead of trusting this script.
NOTE: YOUR ACCOUNT KEY NEEDS TO BE DIFFERENT FROM YOUR DOMAIN KEY.
Prerequisites:

openssl
python

Example: Generate an account keypair, a domain key and csr, and have the domain csr signed.
$ openssl genrsa 4096 > user.key
$ openssl rsa -in user.key -pubout > user.pub
$ openssl genrsa 4096 > domain.key
$ openssl req -new -sha256 -key domain.key -subj “/CN=example.com” > domain.csr
$ python sign_csr.py –public-key user.pub domain.csr > signed.crt
positional arguments:
csr_path              path to your certificate signing request
optional arguments:
-h, –help            show this help message and exit
-p PUBLIC_KEY, –public-key PUBLIC_KEY
path to your account public key
-e EMAIL, –email EMAIL
contact email, default is webmaster@>shortest_domain>
-f, –file-based      if set, a file-based response is used

$ openssl genrsa 4096 > user.key
$ openssl rsa -in user.key -pubout > user.pub
$ openssl genrsa 4096 > domain.key
$ openssl req -new -sha256 -key domain.key -subj "/CN=example.com" > domain.csr
$ python sign_csr.py --public-key user.pub domain.csr > signed.crt

user@hostname:~$ openssl genrsa 4096 > user.key
Generating RSA private key, 4096 bit long modulus
.............................................................................................................................................................................++
....................................................++
e is 65537 (0x10001)
user@hostname:~$ openssl rsa -in user.key -pubout > user.pub
writing RSA key
user@hostname:~$ openssl genrsa 4096 > domain.key
Generating RSA private key, 4096 bit long modulus
.................................................................................................................................................................................++
...........................................++
e is 65537 (0x10001)
user@hostname:~$ openssl req -new -sha256 -key domain.key -subj "/CN=www.example.com" > domain.csr
user@hostname:~$ python sign_csr.py --public-key user.pub domain.csr > signed.crt
Reading pubkey file...
Found public key!
Reading csr file...
Found domains www.example.com
STEP 1: What is your contact email? ([email protected])
Building request payloads...
STEP 2: You need to sign some files (replace 'user.key' with your user private key).
openssl dgst -sha256 -sign user.key -out register_KN2ihH.sig register_ABUO4T.json
openssl dgst -sha256 -sign user.key -out domain_BbpWG4.sig domain_rSKa5G.json
openssl dgst -sha256 -sign user.key -out challenge_fo6_ib.sig challenge_e3gHzd.json
openssl dgst -sha256 -sign user.key -out cert_36OUdW.sig cert_3IZULZ.json
Press Enter when you’ve run the above commands in a new terminal window…
Registering [email protected]…
Already registered. Skipping…
Requesting challenges for www.example.com…
STEP 3: You need to sign some more files (replace ‘user.key’ with your user private key).
openssl dgst -sha256 -sign user.key -out response_ATE3Yu.sig response_P87LMt.json
Press Enter when you’ve run the above commands in a new terminal window…
STEP 4: You need to run this command on www.example.com (don’t stop the python command until the next step).
sudo python -c “import BaseHTTPServer; 

h = BaseHTTPServer.BaseHTTPRequestHandler; 

h.do_GET = lambda r: r.send_response(200) or r.end_headers() or r.wfile.write(‘dKsTWOsqGuOIBep_DYGpXOFqc_aLMu8HiXKMZ8xvsww.1Gt_C6ImtCNs62Zb5YArtvUOnWTp6MkprcNt88ZgUp8’); 

s = BaseHTTPServer.HTTPServer((‘0.0.0.0’, 80), h); 

s.serve_forever()”
Press Enter when you’ve got the python command running on your server…
Requesting verification for www.example.com…
Waiting for www.example.com challenge to pass…
Passed www.example.com challenge!
Requesting signature…
Certificate signed!
You can stop running the python command on your server (Ctrl+C works).
user@hostname:~$ cat signed.crt
—–BEGIN CERTIFICATE—–
MIIGJTCCBQ2gAwIBAgISATBRUGjFwTtjF4adpF7zd/5qMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMTAeFw0xNTEwMjQwOTU4MDBaFw0x
NjAxMjIwOTU4MDBaMCoxKDAmBgNVBAMTH2xldHNlbmNyeXB0LmRheWxpZ2h0cGly
YXRlcy5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2Ac7twhMz
AxreQxmlY0gBq20zrriMOCLTwwdJ3sfv9bNxo+iG7eidu9imLI0FNjZkxtpyJeG/
+4OnvTgChHiTEKtD0Q3SoeSOu3Bl73d4bVBfTsvj0yEoMrF4Y89VvqbH7HP+2evv
Uraj2Qv0EUor3KAsOJW4hiSQedmz69+3IVZHWdpyYTtC1HjO9C5DqPgD7hlrtRrP
k0SL4j048NIiDvMm36pzn/UM+HxuavVxIyQ7BigDk7Hev6jXH2BqQk0ADtR0CycI
nJeS5gk+i6ImDeOsrhPrXvub02aRbol/paoSknskAOJKe4628dd873QfMXnQz1JT
aggaFQA1S8M2DY9l574/gOH39BudXdvOGzln7MeDJoi7Tybih2FJJbj8tQPV2zwh
ArbKLHPJibM1HP8jc7QQcrWnNf3H2N5FhP8uvEVchdYk3zV2tJPqlQnsHctOjNrV
18WRsl+JpUNLclRWQ3JLYZL+waIaJvsAsjp58J3XK1PI1s7QPuJpI3u7hlu4zz2e
TMF8OqAEy+rkHML5j+ncB+ctxhgNgirwpCUQ3NL9rslte0OmO+kzjrVfJ7o5D6zt
Hn5xg2WTgNoCdXbIruEzC43SqkPIH8VeFkzjPCqGajQsXXmdbDyoNkJ+SK0Fz0hI
3alW4kaOSe0aeto22sKtOjsIy7GF6qDw4QIDAQABo4ICIzCCAh8wDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
AjAAMB0GA1UdDgQWBBSpGhk6yOALnLPWzrncMA/wnd6nNzAfBgNVHSMEGDAWgBSo
SmpjBH3duubRObemRWXv86jsoTBwBggrBgEFBQcBAQRkMGIwLwYIKwYBBQUHMAGG
I2h0dHA6Ly9vY3NwLmludC14MS5sZXRzZW5jcnlwdC5vcmcvMC8GCCsGAQUFBzAC
hiNodHRwOi8vY2VydC5pbnQteDEubGV0c2VuY3J5cHQub3JnLzAqBgNVHREEIzAh
gh9sZXRzZW5jcnlwdC5kYXlsaWdodHBpcmF0ZXMub3JnMIIBAAYDVR0gBIH4MIH1
MAoGBmeBDAECATAAMIHmBgsrBgEEAYLfEwEBATCB1jAmBggrBgEFBQcCARYaaHR0
cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwgasGCCsGAQUFBwICMIGeDIGbVGhpcyBD
ZXJ0aWZpY2F0ZSBtYXkgb25seSBiZSByZWxpZWQgdXBvbiBieSBSZWx5aW5nIFBh
cnRpZXMgYW5kIG9ubHkgaW4gYWNjb3JkYW5jZSB3aXRoIHRoZSBDZXJ0aWZpY2F0
ZSBQb2xpY3kgZm91bmQgYXQgaHR0cHM6Ly9sZXRzZW5jcnlwdC5vcmcvcmVwb3Np
dG9yeS8wDQYJKoZIhvcNAQELBQADggEBADQ2nWJa0jSOgStC7luKLmNOiNZTbiYP
ITFetj6WpRIsAHwz3vTwDIWFtczrhksWRTU9mCIwaxtqflZrirc3mE6jKugeSUHr
1yqTXZ097rDNAnMvUtvoET/UBkAU+gUDn8zRFtKOePuWX7P8qHq8QqjNqMC0vb5s
ncyFqSSZl1j9e5l+Kpj/GeTCwkwck5U75Ry44kPbnu5JLd70P724gBnyEi6IxXHB
txXZEUmI0R1Ee3Kw/5N6JfeWNE1KEmM47VVFomRitruxBj9nlXtIILvkPCTWkDua
pr1OmFi/rUcaHw+Txbs8aBmZEBkxy9HPSfgqqlYqEd0ipGqFtqaFJEI=
—–END CERTIFICATE—–
user@hostname:~$

$ wget https://github.com/hlandau/acme/releases/download/v0.0.22/acmetool-v0.0.22-linux_amd64.tar.gz
$ tar -xvf acmetool-v0.0.22-linux_amd64.tar.gz
$ cd acmetool-v0.0.22-linux_amd64
$ bin/acmetool --help

$ bin/acmetool help
usage: acmetool [<flags>] <command> [<args> ...]
Flags:
–help                         Show context-sensitive help (also try –help-long and –help-man).
–state=/var/lib/acme          Path to the state directory (env: ACME_STATE_DIR)
–hooks=/usr/lib/acme/hooks    Path to the notification hooks directory (env: ACME_HOOKS_DIR)
–batch                        Do not attempt interaction; useful for cron jobs
–stdio                        Don’t attempt to use console dialogs; fall back to stdio prompts
–response-file=RESPONSE-FILE  Read dialog responses from the given file
–version                      Print version information
–xlog.facility=XLOG.FACILITY  syslog facility to use
–xlog.syslog                  log to syslog?
–xlog.syslogseverity=XLOG.SYSLOGSEVERITY
syslog severity limit
–xlog.journal                 log to systemd journal?
–xlog.journalseverity=XLOG.JOURNALSEVERITY
systemd journal severity limit
–xlog.severity=XLOG.SEVERITY  log severity (any syslog severity name or number)
–xlog.file=XLOG.FILE          log to filename
–xlog.fileseverity=XLOG.FILESEVERITY
file logging severity limit
–xlog.stderr                  log to stderr?
–xlog.stderrseverity=XLOG.STDERRSEVERITY
stderr logging severity limit
–service.cpuprofile=SERVICE.CPUPROFILE
Write CPU profile to file
–service.debugserveraddr=SERVICE.DEBUGSERVERADDR
Address for debug server to listen on (do not specify a public address) (default: disabled)
–service.uid=SERVICE.UID      UID to run as (default: don’t drop privileges)
–service.gid=SERVICE.GID      GID to run as (default: don’t drop privileges)
–service.daemon               Run as daemon? (doesn’t fork)
–service.chroot=SERVICE.CHROOT
Chroot to a directory (must set UID, GID) ("/" disables)
–service.pidfile=SERVICE.PIDFILE
Write PID to file with given filename and hold a write lock
–service.fork                 Fork? (implies -daemon)
Commands:
help [<command>…]
Show help.
reconcile*
Reconcile ACME state
want <hostname>…
Add a target with one or more hostnames
quickstart [<flags>]
Interactively ask some getting started questions (recommended)
redirector [<flags>]
HTTP to HTTPS redirector with challenge response support
test-notify [<hostname>…]
Test-execute notification hooks as though given hostnames were updated
import-jwk-account <provider-url> <private-key-file>
Import a JWK account key
import-key <private-key-file>
Import a certificate private key
import-le [<le-state-path>]
Import a Let’s Encrypt client state directory

$ sudo acmetool want www.example.com

$ wget https://github.com/xenolf/lego/releases/download/v0.1.0/lego_linux_amd64.tar.gz
$ tar -xvf lego_linux_amd64.tar.gz
lego
LICENSES.txt
README.txt
$ ./lego help

# ./lego help
NAME:
   lego - Let's encrypt client to go!
USAGE:
./lego [global options] command [command options] [arguments…]
VERSION:
0.1.0
COMMANDS:
run		Register an account, then create and install a certificate
revoke	Revoke a certificate
renew	Renew a certificate
help, h	Shows a list of commands or help for one command
GLOBAL OPTIONS:
–domains, -d [–domains option –domains option]			Add domains to the process
–server, -s “https://acme-v01.api.letsencrypt.org/directory"	CA hostname (and optionally :port). The server certificate must be trusted in order to avoid further modifications to the client.
–email, -m 								Email used for registration and recovery contact.
–rsa-key-size, -B “2048”						Size of the RSA key.
–path “/opt/le5-lego/dl/.lego”					Directory to use for storing the data
–port 								Challenges will use this port to listen on. Please make sure to forward port 443 to this port on your machine. Otherwise use setcap on the binary
–help, -h								show help
–version, -v							print the version

$ sudo ./lego --email="[email protected]" --domains="www.example.com" run

$ sudo ./lego --email="[email protected]" --domains="www.example.com" run
2015/12/13 17:32:25 No key found for account [email protected]. Generating a 2048 bit key.
2015/12/13 17:32:26 Saved key to /opt/le5-lego/dl/.lego/accounts/acme-v01.api.letsencrypt.org/[email protected]/keys/[email protected]
2015/12/13 17:32:26 [INFO] acme: Registering account for [email protected]
2015/12/13 17:32:27 !!!! HEADS UP !!!!
2015/12/13 17:32:27
		Your account credentials have been saved in your Let's Encrypt
		configuration directory at "/opt/le5-lego/dl/.lego/accounts/acme-v01.api.letsencrypt.org/[email protected]".
		You should make a secure backup	of this folder now. This
		configuration directory will also contain certificates and
		private keys obtained from Let's Encrypt so making regular
		backups of this folder is ideal.
2015/12/13 17:32:27 Please review the TOS at https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf
2015/12/13 17:32:27 Do you accept the TOS? Y/n
Y
2015/12/13 17:32:30 [INFO] acme: Obtaining bundled SAN certificate for www.example.com
2015/12/13 17:33:02 [INFO] acme: Trying to solve TLS-SNI-01
2015/12/13 17:33:04 The server validated our request
2015/12/13 17:33:04 [INFO] acme: Validations succeeded; requesting certificates
2015/12/13 17:33:05 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert
2015/12/13 17:33:05 [www.example.com] Server responded with a certificate.

$ git clone https://github.com/lukas2511/letsencrypt.sh
$ ./letsencrypt.sh --help

$ ./letsencrypt.sh --help
Usage: ./letsencrypt.sh [-h] [command [argument]] [parameter [argument]] [parameter [argument]] ...
Default command: cron
Commands:
–cron (-c)                      Sign/renew non-existant/changed(TODO)/expiring certificates.
–sign (-s) domain.tld           Force-sign specific certificate from domains.txt, even if not yet expiring or changed.
–revoke (-r) path/to/cert.pem   Revoke specified certificate
–help (-h)                      Show help text
Parameters:
–config (-f) path/to/config.sh  Use specified config file
–privkey (-p) path/to/key.pem   Use specified private key instead of account key (useful for revocation)

example.com www.example.com
example.net www.example.net wiki.example.net

WELLKNOWN="${SCRIPTDIR}/.well-known/acme-challenge"

$ ./letsencrypt.sh
Using config file /opt//letsencrypt.sh/config.sh
Processing www.example.com
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for www.example.com...
 + Responding to challenge for www.example.com...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Creating fullchain.pem...
 + Done!
$ ./letsencrypt.sh
Using config file /opt//letsencrypt.sh/config.sh

Found existing cert…
Valid till Mar 12 22:42:00 2016 GMT (Longer than 14 days). Skipping!

$ git clone https://github.com/kelunik/acme-client
$ cd acme-client
$ composer install

# Register the Let's Encrypt account
$ sudo bin/acme register \
    --server acme-v01.api.letsencrypt.org/directory \
    --email [email protected]

# Issue the certificate
$ sudo bin/acme issue \
    --server acme-v01.api.letsencrypt.org/directory \
    --domains example.com,www.example.com \
    --path /var/www/example.com/htdocs

$ git clone https://github.com/analogic/lescript.git
$ cd lescript