The official let's encrypt client is very heavy-weight. In my case I've build a much simpler thing using acmetool (<a href="https://github.com/hlandau/acme" rel="nofollow">https://github.com/hlandau/acme</a>) which is mcuh simpler to use and nicely runs without root rights.<p>In my case, a lot of the routing of domains to customers is stored in a postgres database and a trigger fires an event anyways, so I have a little daemon that listens to these events and the fires off acmetool as needed in order go generate certificates.<p>I just completed this last week, so when I've seen this article here, I thought that I just wasted some time over this because now there's an integrated nginx solution, but thankfully, this is just an article about doing what I was doing using a tool that's more complicated to use and brings half of an OS installation as dependencies.<p>For those interested, <a href="https://gist.github.com/pilif/1e2610dd7aa57323e0b2" rel="nofollow">https://gist.github.com/pilif/1e2610dd7aa57323e0b2</a> is the script in question. It's really a quick hack, but it works very well for me to auto-create nginx config files.