Indeed. As I understand it, *BSD users are currently left out of wildcard certs from Let's Encrypt. HN runs behind an nginx proxy because the forum software doesn't support HTTPS.
As on my Linux and Synology machines, the bash script has broken once or twice because it’s against modern best practices to define and stick with stable protocols.
Sometimes I think it would be easier to rewind to the 90’s web and build a sane ecosystem on top of that. Every aspect of the web that I interact with has gotten worse in the last decade.
(Also, HN’s is using a non-wildcard cert from digicert, at least according to my web browser).
The Arc Language app that this forum runs on doesn't support HTTPS, so wherever the cert comes from, accessing the site is through a reverse proxy.
https://man.openbsd.org/acme-client.1
I chose the bash client over the python client because I didn’t want to use pip to pull unvetted software from randos on the Internet. (Also, I hate python, and eliminating use cases for it makes me happy.)
Anyway, the bash script is still quite popular, and is extremely reliable. Since I used it, they eliminated the bash dependency, and now it is unix shell compliant:
https://github.com/acmesh-official/acme.sh
I would definitely use it in the future if I was configuring a Linux box to renew certificates.
The breakages I encountered were all on the Let’s Encrypt side, and broke all the clients, including the official one.
Anyway, it has been trivial to use Let’s Encrypt with OpenBSD for many years.