lego

by go-acme

9.1Kstars

1.1Kforks

93watchers

Updated 3 months ago

About

Lego is a Go-based ACME client and library that automates obtaining, renewing, and managing TLS certificates from Let's Encrypt and other ACME-compatible CAs.

Let's Encrypt/ACME client and library written in Go

Primary Use Case

This tool is primarily used by developers, system administrators, and DevOps engineers to automate the lifecycle of TLS certificates, enabling secure HTTPS for websites and services. It supports integration as both a CLI tool and a Go library, making it suitable for automated certificate management in diverse environments.

Key Features

Full support for ACME v2 protocol (RFC 8555) and related extensions
Integration with approximately 150 DNS providers for DNS-01 challenge automation
Supports HTTP-01, DNS-01, and TLS-ALPN-01 ACME challenges
Certificate issuance from scratch or using an existing CSR
Certificate renewal and revocation capabilities
SAN (Subject Alternative Name) certificate support
Custom challenge solvers for flexible validation
OCSP helper functions and certificate bundling

Installation

Refer to https://go-acme.github.io/lego/installation/ for detailed installation steps
Install via Go modules: go get github.com/go-acme/lego/v4
Use the official Docker image: docker pull goacme/lego

Usage

>_ lego --help

Displays help information and available commands for the CLI.

>_ lego --email [email protected] --domains example.com --http run

Obtain a certificate for example.com using the HTTP-01 challenge.

>_ lego --email [email protected] --domains example.com --dns cloudflare run

Obtain a certificate for example.com using the DNS-01 challenge with Cloudflare DNS provider.

>_ lego renew

Renew all certificates that are near expiration.

>_ lego revoke --cert path/to/cert.pem

Revoke a previously issued certificate.

Security Frameworks

Initial Access

Defense Evasion

Credential Access

Discovery

Execution

Usage Insights

Integrate lego into CI/CD pipelines to automate TLS certificate issuance and renewal, reducing human error and improving security posture.
Use lego's DNS-01 challenge automation to securely validate domain ownership without exposing HTTP endpoints, enhancing defense against domain hijacking.
Leverage lego's custom challenge solvers to adapt certificate issuance workflows to complex or proprietary environments.
Combine lego with monitoring tools to detect certificate expiry proactively and prevent service outages or security warnings.
Employ lego as part of a purple team exercise to simulate attacker attempts to manipulate certificate issuance and test detection and response capabilities.