.TH acmetool 8  "acmetool"
.SH "NAME"
acmetool - request certificates from ACME servers automatically
.SH "SYNOPSIS"
.TP
\fBacmetool [<flags>] <command> [<args> ...]\fR

.SH "DESCRIPTION"
acmetool is a utility for the automated retrieval, management and renewal of
certificates from ACME server such as Let's Encrypt. It emphasises automation,
idempotency and the minimisation of state.

You use acmetool by configuring targets (typically using the "want") command.
acmetool then requests certificates as necessary to satisfy the configured
targets. New certificates are requested where existing ones are soon to expire.

acmetool stores its state in a state directory. It can be specified on
invocation via the --state option; otherwise, the path in ACME_STATE_DIR is
used, or, failing that, the path "/var/lib/acme" (recommended).

The --xlog options control the logging. The --service options control privilege
dropping and daemonization and are applicable only to the redirector subcommand.

.SH "OPTIONS"
.TP
\fB--help\fR
Show context-sensitive help (also try --help-long and --help-man).
.TP
\fB--state=/var/lib/acme\fR
Path to the state directory (env: ACME_STATE_DIR)
.TP
\fB--hooks=/etc/acme/hooks\fR
Path to the notification hooks directory (env: ACME_HOOKS_DIR)
.TP
\fB--batch\fR
Do not attempt interaction; useful for cron jobs. (acmetool can still obtain responses from a response file, if one was provided.)
.TP
\fB--stdio\fR
Don't attempt to use console dialogs; fall back to stdio prompts
.TP
\fB--response-file=RESPONSE-FILE\fR
Read dialog responses from the given file (default: $ACME_STATE_DIR/conf/responses)
.TP
\fB--version\fR
Print version information
.TP
\fB--xlog.facility=daemon\fR
Syslog facility to use
.TP
\fB--xlog.syslog\fR
Log to syslog?
.TP
\fB--xlog.syslogseverity=DEBUG\fR
Syslog severity limit
.TP
\fB--xlog.journal\fR
Log to systemd journal?
.TP
\fB--xlog.journalseverity=DEBUG\fR
Systemd journal severity limit
.TP
\fB--xlog.severity=NOTICE\fR
Log severity (any syslog severity name or number)
.TP
\fB--xlog.file=""\fR
Log to filename
.TP
\fB--xlog.fileseverity=TRACE\fR
File logging severity limit
.TP
\fB--xlog.stderr\fR
Log to stderr?
.TP
\fB--xlog.stderrseverity=TRACE\fR
stderr logging severity limit
.TP
\fB--service.cpuprofile=""\fR
Write CPU profile to file
.TP
\fB--service.debugserveraddr=""\fR
Address for debug server to listen on (do not specify a public address) (default: disabled)
.TP
\fB--service.uid=""\fR
UID to run as (default: don't drop privileges)
.TP
\fB--service.gid=""\fR
GID to run as (default: don't drop privileges)
.TP
\fB--service.daemon\fR
Run as daemon? (doesn't fork)
.TP
\fB--service.stderr\fR
Keep stderr open when daemonizing
.TP
\fB--service.chroot=""\fR
Chroot to a directory (must set UID, GID) ("/" disables)
.TP
\fB--service.pidfile=""\fR
Write PID to file with given filename and hold a write lock
.TP
\fB--service.fork\fR
Fork? (implies -daemon)
.SH "SUBCOMMANDS"
.SS
\fBhelp [<command>...]\fR
.PP
Show help.
.SS
\fBreconcile\fR
.PP
Reconcile ACME state, idempotently requesting and renewing certificates to satisfy configured targets.

This is the default command.
.SS
\fBcull [<flags>]\fR
.PP
Delete expired, unused certificates
.TP
\fB-n, --simulate\fR
Show which certificates would be deleted without deleting any
.SS
\fBstatus\fR
.PP
Show active configuration
.SS
\fBwant [<flags>] <hostname>...\fR
.PP
Add a target with one or more hostnames
.TP
\fB--reconcile\fR
Specify --no-reconcile to skip reconcile after adding target
.SS
\fBunwant <hostname>...\fR
.PP
Modify targets to remove any mentions of the given hostnames
.SS
\fBquickstart [<flags>]\fR
.PP
Interactively ask some getting started questions (recommended)
.TP
\fB--expert\fR
Ask more questions in quickstart wizard
.SS
\fBredirector [<flags>]\fR
.PP
HTTP to HTTPS redirector with challenge response support
.TP
\fB--path=PATH\fR
Path to serve challenge files from
.TP
\fB--challenge-gid=CHALLENGE-GID\fR
GID to chgrp the challenge path to (optional)
.SS
\fBtest-notify [<hostname>...]\fR
.PP
Test-execute notification hooks as though given hostnames were updated
.SS
\fBimport-jwk-account <provider-url> <private-key-file>\fR
.PP
Import a JWK account key
.SS
\fBimport-pem-account <provider-url> <private-key-file>\fR
.PP
Import a PEM account key
.SS
\fBimport-key <private-key-file>\fR
.PP
Import a certificate private key
.SS
\fBimport-le [<le-state-path*>]\fR
.PP
Import a Let's Encrypt client state directory
.SS
\fBrevoke [<certificate-id-or-path>]\fR
.PP
Revoke a certificate
.SS
\fBaccount-thumbprint\fR
.PP
Prints account thumbprints
.SH "AUTHOR"
© 2015 Hugo Landau <hlandau@devever.net>  MIT License
.SH "SEE ALSO"
Documentation: <https://github.com/hlandau/acme>

Report bugs at: <https://github.com/hlandau/acme/issues>