Show HN: Tiny acmecli for ACMEv2 account mgmt and for DNS-persist-01 (opens in new tab)

Over the years I've used many acme clients, and noticed that a lot of them often lack acmev2 account management functions. It is also non-trivial to migrate between them with keeping your acme account, especially certbot that stores your account private_key as JSON Web Key format, while others just use PEM. Also, most of them do not have an easy way "to import" your account, or it is not documented anywhere.

Keeping your acme account_uri is worth it every time you already have your CAA records in place and changing them is a chore, or takes too much time in a corporate environment.

This small acmecli.py is designed to help you migrate from client to client while re-using your account private key, convert your account private key betwen JWK and PEM, getting your account_uri and thumbprint, rekey or deactivate your acmev2 account(s) you no longer plan to use.

Mostly focused to help you setup stateless challenge methods, like stateless http-01 or upcoming dns-persist-01.

It does not obtain any certificates, it does not handle any challenges, but may be of help to you nonetheless, to augument your certbot, lego or uacme with missing functions.

Missing stuff: PEM keys could be PKCS#1 or PKCS#8, this tool can't detect or covert between them. It reads and outputs whatever your python cryptography is linked with (usually it reads any type, but outputs PKCS#8).

Cheers,