> Oh, and that 500-line shell script probably ends up being a 5000-line Python monster anyway.

The dehydrated ACME client is 2400 lines of bash/zsh:

* https://github.com/dehydrated-io/dehydrated

And its external dependencies are OpenSSL and cURL. The acme.sh shell ACME client is 8000 lines of shell:

* https://github.com/acmesh-official/acme.sh

The official Let's Encrypt client is written in Python, and the core 'executable' is much longer, and in addition it pulls in a boatload of dependencies:

* https://packages.debian.org/bullseye/python3-certbot

I'm not sure why -- the one shipped with 9front is less than a thousand lines of C, and supports both DNS and HTTP challenges:

https://git.9front.org/plan9front/plan9front/HEAD/sys/src/cm...

http://man.9front.org/8/acmed

The ACME protocol isn't that complicated.