<pre>
usage: create_csr [-h] [--renew [domain ...]] [--new domain [domain ...]]
                  [--forget domain [domain ...]] [--log LOG]
                  [--service service] [--directory dir] [--config filename]

Automate request of certs from letsencrypt

options:
  -h, --help            show this help message and exit
  --renew [domain ...]  Renew existing certificates. By default only
                        certificates which are about to expire would be
                        renewed. Explicitely specified certs would be renewed
                        regardless of expiration date
  --new domain [domain ...]
                        Create new cert for specified domain(s)
  --forget, -f domain [domain ...]
                        Forget cert for specified domain
  --log, -l LOG         Log level. DEBUG, INFO, WARNING or number
  --service, -s service 
                        names of services (comma separated) to restartwhen
                        this certificate is renewed
  --directory, -d dir   Directory for new cert and keys
  --config, -c filename 
                        Alternate config file. It is read on --renew and
                        written on --new and --forget

This script automates generation of certificate requests to renew certificates
from letsencrypt certification authority. Script uses acme_tiny to actually
request certificates. It reads configuration file /etc/acme.cert to search for
certificates throughout a file system. By default, it tries to renew
certificate only if there is less than week before its expiration date. But
you can specify domain in the command line to force renewal now. Configuration
file can list services which should be restarted after installation of the
newly issued certificate. When invoked with --new option it requests
certificate for the specifed domain and adds a line to this configuration
file. If more than one domain is specified for --new option, only one
certificate is created, all other domains go into SAN extensions. When invoked
with --forget option - removes line as well as certificate and key. If
standard output is not a terminal, all output is send by mail to invoking user
(provided that /usr/sbin/sendmail is working on your server and knows how to
deliver mail without domains).
</pre>