lego is an ACME client and Go library with a broad DNS provider ecosystem. It can register accounts, solve challenges, issue certificates, renew them, revoke them, and store the resulting material on disk. The simplicity of the command is a strength. It also makes the surrounding operational contract easy to leave implicit.
Define one authoritative native workspace
A lego deployment usually has a working directory, configuration, credentials, accounts, certificate resources, private keys, and archives. Treat that complete set as one native workspace. Document its owner, backup boundary, and the exact commands or service allowed to mutate it.
A second tool should not casually import the files and create another desired-state copy. Once two systems believe they own renewal settings or certificate material, source-of-truth questions appear during the worst moments: an expiration incident, a failed migration, or an ambiguous partial run.
Protect every parent directory against untrusted replacement and symbolic-link redirection. The service account needs the ability to update certificate storage, but unrelated users and services should not be able to replace configuration or credential files between review and execution.
Pin and inspect the executable you intend to run
A version string is useful but incomplete. Builds from the same source can differ through toolchain, flags, patches, or compromised artifacts. Retain the source identity, published checksum or locally established digest, platform, and build information for the executable in service.
Place it at an absolute path owned by root or the isolated service identity. Remove group and other write permissions. Avoid search-path discovery in automation. If low-port HTTP validation requires a Linux capability, grant only cap_net_bind_service to the lego executable and record that exception; do not run the complete certificate service as root.
Control the provider environment
Many lego providers use environment variables. Do not inherit the service manager's entire environment and hope the right credential wins. Construct an allowlist for the selected provider and authentication mode. Explicitly disable fallback paths you do not intend, such as instance metadata or implicit home-directory profiles.
Credential files should be regular files with confidential permissions, no links, known ownership, bounded size, and predictable syntax. Avoid variables or command expansion in dotenv files. Keep secret values out of logs, process arguments, browser responses, and durable operation metadata.
Schedule evaluation and let lego decide renewal
A daily timer does not need to force a daily certificate. Its job is to give lego regular opportunities to evaluate the native workspace. lego can use ACME Renewal Information, configured remaining-life thresholds, dynamic lifetime rules, and random delay to decide whether a certificate is due.
Avoid scheduling every host at midnight. Select a stable off-peak time and preserve jitter. Record both the operator's time zone and the resulting UTC instant. Decide what happens across daylight-saving transitions, long downtime, and clock rollback; a missed week should usually coalesce into one evaluation rather than launch a backlog.
Prevent overlapping mutations
Do not run manual issuance, scheduled renewal, configuration editing, inventory reads that assume stable files, and backup restoration concurrently against one workspace. Use a shared lock or service-level lease that every mutating path respects.
After a process interruption, do not automatically replay a command whose external outcome is unknown. The CA may have issued a certificate and the DNS provider may have changed records even when the local process never stored a final result. Inspect native files, provider state, and CA evidence first.
Separate issuance from certificate deployment
lego writes certificate material. A reverse proxy, load balancer, secret store, or application must then activate it. These are two transactions. The deployment step should verify that the certificate and private key match, validate names and validity, stage the complete new material, switch atomically, reload safely, and confirm what the public endpoint serves.
Give the deployer only the authority it needs. A generic post-renew shell hook running with the certificate service identity can turn an ACME compromise into broad host compromise. A separate restricted service or deployment API is easier to reason about and audit.
AcmeMux provides runtime review, native configuration forms, constrained whole-workspace execution, a durable daily schedule, current certificate health, and one redacted latest result. It deliberately leaves lego, the native workspace, and certificate deployment in their existing ownership domains.
Operational checklist
- Use one documented workspace and one isolated service identity.
- Pin the executable by exact source and byte identity.
- Allowlist provider variables and disable unintended credential fallbacks.
- Serialize workspace edits and ACME operations.
- Run daily evaluation at a non-midnight time without forcing renewal.
- Back up application state and native certificate material as separate units.
- Deploy certificates through a restricted, verified, atomic path.
- Observe the live endpoint after activation.