Standalone

One binary on a host that has outbound internet access — the certbot-shaped mode. The host talks directly to the CA and your DNS provider.

Use it when the host getting the certificate can make outbound HTTPS calls but can't be reached inbound from the internet (the common case for internal services behind a firewall or NAT).

Flow

gapcert issue ──HTTPS──► ACME CA (Let's Encrypt, ...)
              ──API───►  DNS provider  (publishes _acme-challenge TXT)

The quickstart is the full standalone walkthrough. In short:

$ gapcert issue
web                  obtaining [web.internal.example.com] via challenge-zone ...
web                  stored ~/.local/share/gapcert/certs/web
web                  hook ok

$ gapcert status
NAME                 DOMAINS                                  EXPIRES        DAYS  STATUS
web                  web.internal.example.com                 2026-10-24       88  ok

Where things are stored

Under data_dir (default ~/.local/share/gapcert):

accounts/<ca-host>/<email>/   ACME account key + registration
certs/<name>/cert.pem         leaf + chain (fullchain)
certs/<name>/key.pem          private key (0600)
certs/<name>/issuer.pem       issuer chain
certs/<name>/meta.json        issuance metadata

Writes are atomic (temp file + rename), so a crash mid-renewal never leaves a half-written key or certificate.

Trade-off

Every standalone host holds a DNS-provider credential. That's fine for a handful of trusted hosts; for a fleet, keep the credentials on one machine with the broker instead, so hundreds of hosts never touch cloud secrets. Scope the credential regardless — delegate the challenge to a dedicated zone (see configuration).