Option to override trust store used to tls-verify the ACME server

[bn-jbischko]

Welcome

• Yes, I've searched similar issues on GitHub and didn't find any.

How do you use lego?

Binary

Detailed Description

Lego has a --tls-skip-verify option, to skip verification of the ACME-server's TLS certificate altogether. From the help text:

   --tls-skip-verify                                            Skip the TLS verification of the ACME server. (default: false)

In some cases, when using a custom ACME-server to attain client certificates, it would be useful to have a similar option, that enables one to specify a pem bundle used to verify the ACME-server connection instead of skipping verification altogether, say --trusted-acme-servers. I'm aware, that I could edit the system's trust store, but in some cases that is not feasable or wanted.

[sevenrats]

you can set the environment variable LEGO_CA_CERTIFICATES pointed at a pem-encoded store and lego will trust the roots in that store.