lego
What it is
lego is a free, open-source ACME client and Go library for obtaining, renewing, and revoking certificates. It supports wildcard and SAN certificates, with DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01 validation methods. It can work with multiple ACME servers, including Let’s Encrypt and ZeroSSL, and lists support for more than 200 DNS providers. Examples include Cloudflare, Amazon Route 53, Google Cloud DNS, and Azure DNS; CNAME support is enabled by default.
Use lego from the command line or as a Go library. DNS provider settings and credentials are supplied through environment variables, including values read from files or dotenv files. Installation choices include prebuilt binaries, Docker, package managers, and building from source. Maintainers maintain the AUR and Snap packages; other listed packages are community maintained. The project lists support for ACME RFC 8555 and related certificate validation and renewal extensions. The repository uses the MIT license. Building from source requires Go 1.25 or later, and the project points users to GitHub issues and discussions for help.
For and against
For
- Free and open source under the MIT license
- Can obtain, renew, and revoke certificates
- Supports multiple ACME challenge methods
- Lists more than 200 DNS providers
- Available as a CLI and Go library
Against
- Building from source requires Go 1.25 or later
- Some listed packages are community maintained
The verdict
lego offers certificate management through either a command-line client or a Go library, with many DNS provider integrations and challenge options. It is a practical fit for users comfortable configuring ACME and DNS credentials.
Who it suits
lego suits developers and operators who need an ACME client for certificate issuance and renewal, including people automating certificate workflows or embedding certificate operations in Go software.
Plans and prices
Free and open-source
Independent project; no paid plans stated
Read 11 Oct 2026 · go-acme.github.io
On the record
- ACME servers
- It supports multiple ACME servers, including Let’s Encrypt and ZeroSSL.go-acme.github.io · read 11 Oct 2026
- Certificate authorities
- It supports multiple ACME servers, including Let’s Encrypt and ZeroSSL.go-acme.github.io · read 11 Oct 2026
- Certificate management
- It can obtain, renew, and revoke certificates.go-acme.github.io · read 11 Oct 2026
- Certificate operations
- It can obtain, renew, and revoke certificates, including wildcard and SAN certificates.go-acme.github.io · read 11 Oct 2026
- Certificate types
- It supports wildcard and SAN certificates.go-acme.github.io · read 11 Oct 2026
- Challenge methods
- Supported validation challenges include DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01.go-acme.github.io · read 11 Oct 2026
- Challenges
- It supports DNS-01, HTTP-01, TLS-ALPN-01, and DNS-PERSIST-01 challenges.go-acme.github.io · read 11 Oct 2026
- CNAME
- CNAME is supported by default.go-acme.github.io · read 11 Oct 2026
- Credential configuration
- DNS provider credentials and configuration are passed through environment variables, including values loaded from files or dotenv files.go-acme.github.io · read 11 Oct 2026
- Distribution
- The project provides binaries for operating systems and architectures, a Docker image, and installation instructions for several package managers.go-acme.github.io · read 11 Oct 2026
- DNS credentials
- DNS provider credentials and configuration are passed through environment variables, with support for file references and dotenv files.go-acme.github.io · read 11 Oct 2026
- DNS integrations
- The project says it supports more than 200 DNS providers, with a provider list in its documentation.go-acme.github.io · read 11 Oct 2026
- DNS providers
- The project says it comes with support for more than 200 DNS providers.go-acme.github.io · read 11 Oct 2026
- Go library
- lego can be used as a Go library as well as a command-line client.github.com · read 11 Oct 2026
- Install options
- The project documents prebuilt binaries, Docker, package managers, and installation from source.go-acme.github.io · read 11 Oct 2026
- License
- The GitHub repository lists the project under the MIT license.github.com · read 11 Oct 2026
- License and cost
- The project describes itself as independent, free, and open source.go-acme.github.io · read 11 Oct 2026
- Package maintenance
- The maintainers maintain the AUR and Snap packages; other listed packages are community maintained.go-acme.github.io · read 11 Oct 2026
