Janne Johansson wrote:

> Did you read https://kristaps.bsd.lv/acme-client/ to see how the
> different parts are protected and use whatever privs they need and
> nothing more?

Thanks for the link. I do understand pledge() and unveil() are used;
however, does that obviate any need to run it as a non-root user?

It appears the original author intended for certificates to be stored
under /etc/ssl/acme and keys under /etc/ssl/acme/private but this
requirement (and any indication of such intent) was dropped at some
point.

Regards
Lloyd