Lego

Go library and command-line tool for obtaining and managing TLS certificates using the ACME protocol. Works with Let's Encrypt and other certificate authorities to obtain, renew, and revoke certificates. Available as both a standalone CLI and an embeddable library for programmatic integration into Go applications.

Independent, community-maintained project developed over roughly a decade. Differentiates with broad RFC coverage: ACME v2, TLS-ALPN challenges, IP address certificates, and renewal information. Supports over 180 DNS providers for domain validation, more than alternatives such as certbot when using DNS-based challenges.

Key features:

• ACME v2 compliant with RFC 8555, TLS-ALPN, IP certificates, and renewal information extensions
• Three challenge types: HTTP, DNS, and TLS-ALPN for flexibility across network setups
• CLI and Go library: run from the shell or import for full programmatic control
• 180+ built-in DNS provider integrations for automated wildcard and multi-domain certificates
• Credentials via environment variables or file references for secure CI/CD and automation

Used by developers to secure web apps and APIs with free TLS, automate certificate renewal in pipelines without downtime, and obtain wildcard certificates via DNS challenge where HTTP is impractical. Common in Go-based infrastructure: Traefik, Caddy, and custom services embed it for built-in certificate management. Internal services and IP-only endpoints benefit from RFC 8738 IP address certificate support.