Lego is an ACME client and library written in Go that automates certificate issuance and renewal with Let's Encrypt and other ACME-compatible certificate authorities.
The tool solves the problem of obtaining and managing TLS certificates by implementing the ACME protocol, which allows automated interaction with certificate authorities. It supports multiple challenge types—HTTP, DNS, and TLS ALPN—to prove domain ownership, with DNS validation backed by integrations with over two hundred DNS providers. The library can obtain certificates from scratch or from an existing certificate signing request, renew expiring certificates, and revoke certificates when needed. It handles SAN certificates and includes CNAME support for delegated validation.
Lego suits projects that need programmatic certificate management in Go applications or require a command-line tool for certificate automation in deployment pipelines. It works well for infrastructure that already uses Let's Encrypt or other ACME CAs and needs flexible challenge solving. The tool is particularly valuable when DNS-based validation is preferred, given the breadth of supported DNS providers. Developers can also write custom challenge solvers to integrate with proprietary systems.
The project maintains active engagement with ACME specification evolution, implementing support for multiple RFCs including those covering TLS ALPN challenges, IP address certificates, renewal information extensions, and emerging draft specifications for profiles and persistent DNS validation. The maintainers respond to requests for new DNS provider integrations through a structured issue template, indicating systematic onboarding of additional integrations.
