acme-tiny is a Python script for issuing and renewing TLS certificates from Let's Encrypt.
The script solves the problem of obtaining and maintaining Let's Encrypt certificates on a server without requiring a full-featured client. It implements the ACME protocol by taking a minimal approach: the script handles account key management, certificate signing requests, domain ownership validation through HTTP challenge files, and certificate renewal. The design prioritizes auditability and simplicity, keeping the implementation under 200 lines and requiring only Python and OpenSSL as dependencies.
The tool is suited for developers and operators who understand public key cryptography and are comfortable managing certificate infrastructure manually. It works well for straightforward deployments where you control the server and can host challenge files at the .well-known/acme-challenge/ path over HTTP. The script requires you to generate and maintain your own Let's Encrypt account private key and certificate signing requests, then orchestrate renewals through cron jobs. If you lack familiarity with cryptographic concepts or prefer automated certificate management without manual key handling, the official Let's Encrypt client is the recommended alternative.
The project maintains a stable, minimal codebase with infrequent changes. Pull requests receive responses but are merged selectively, suggesting careful stewardship of the script's scope and simplicity. Issue discussions show engagement with users on technical questions and edge cases, though resolution is deliberate rather than rapid. The maintainer has explicitly prioritized keeping the implementation auditable and trustworthy rather than adding features, reflecting the security-sensitive nature of handling private account keys.
