… configuration file boilerplate around the prefixes

Doing this with a Makefile won't work good, because it won't delete target files ONLY on error, while leaving them alone if they're intermediate.

I keep telling myself I'll go back to python 2 because at least the shoddy syntax doesn't have a lot of retarded boilerplate for encoding/decoding strings. But I just can't give up that unicode support, even if it is (more) shoddy syntax.

Yeah, maybe I should just go back to python 2. Everything's a bytestring, it's all in utf-8, and urllib is eternally stuck in version 2.

"{0}/directory".format(CA)? really?

Just concatenate...

It should be relatively easy to offer the option to execute the commands, instead of begging the user to do it. I for one generate my private keys with the same account that deals with letsencrypt.org, which technically doesn't protect private keys with unix file permissons, but it's convenient at least. It's nicer anyway, to have a standard syntax for lists of commands anyway, instead of just sticking them in the string and trying to figure out which argument {4} corresponds to.