Using `acme.sh` to renew a certificate as root sounds like a RCE-as-root waiting to happen. A Web client written in pure shell, what could possibly go wrong? I just wrote a script to drop its own privilege when it calls `acme.sh`, so it's safe to use in a root cronjob.
After writing this, I found RCE-as-root is not just "waiting" to happen, it has already happened as CVE-2023-38198. Someone even argued the case as a possible mechanism responsible for the jabber.ru wiretapping incident. https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/
niconiconi
npub1e8…wn3ds
2026-09-16 02:31:21 UTC
Author Public Key
npub1e8tgx6ywtextr0apsd6pctu6wxvut79gal2fc77ukzhpgkkdf7fsswn3dsSeen on
wss://relay.momostr.pinkPublished at
2026-09-16 02:31:21 UTCEvent JSON
{
"id": "ae52325e73df5136225ef4c9abd0644e4b0703a803220f9ef94c620e564928be",
"pubkey": "c9d683688e5e4cb1bfa183741c2f9a7199c5f8a8efd49c7bdcb0ae145acd4f93",
"created_at": 1789525881,
"kind": 1,
"tags": [
[
"proxy",
"https://mk.absturztau.be/notes/ar71tgwjepnw00dx",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://mk.absturztau.be/notes/ar71tgwjepnw00dx",
"pink.momostr"
],
[
"-"
]
],
"content": "Using `acme.sh` to renew a certificate as root sounds like a RCE-as-root waiting to happen. A Web client written in pure shell, what could possibly go wrong? I just wrote a script to drop its own privilege when it calls `acme.sh`, so it's safe to use in a root cronjob.\n\nAfter writing this, I found RCE-as-root is not just \"waiting\" to happen, it has already happened as CVE-2023-38198. Someone even argued the case as a possible mechanism responsible for the jabber.ru wiretapping incident. https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/",
"sig": "6e02b2cc5288e3bdc973465afcefe45beee580b9458976b0e80d88968bf6725a9495a8ba6d5f5049971bf3d718e01fda3f32500fb50b7908b0eb0a33aa76fe7d"
}