Did you read https://kristaps.bsd.lv/acme-client/ to see how the
different parts are protected and use whatever privs they need and
nothing more?

> One of my biggest issues with acme-client(1) - which does string parsing
> of untrusted input from the network - is shown below:
>
> if (getuid() != 0)
>         errx(EXIT_FAILURE, "must be run as root");
>
> AFAIK there is no justified need to run acme-client child processes as
> root, and it could fare better with a dedicated user and some tidying up
> of file locations.


-- 
May the most significant bit of your life be positive.