 --- a/letsencrypt.sh
 +++ b/letsencrypt.sh
-@@ -20,10 +20,17 @@
- 
- BASEDIR="${SCRIPTDIR}"
+@@ -28,10 +28,17 @@
+   mktemp ${@:-} "${TMPDIR:-/tmp}/letsencrypt.sh-XXXXXX"
+ }
  
 +# Prefer libressl over openssl.
 +if [ -x "/usr/bin/libressl-openssl" ]; then

   res=$?
   set -e
   if [[ ${res} -ne 0 ]]; then
@@ -297,7 +304,7 @@
   protected64="$(printf '%s' "${protected}" | urlbase64)"
 
   # Sign header with nonce and our payload with our private key and encode signature as urlbase64
-  signed64="$(printf '%s' "${protected64}.${payload64}" | openssl dgst -sha256 -sign "${PRIVATE_KEY}" | urlbase64)"
+  signed64="$(printf '%s' "${protected64}.${payload64}" | ${OPENSSL} dgst -sha256 -sign "${PRIVATE_KEY}" | urlbase64)"
 
   # Send header + extended header + payload + signature to the acme-server
   data='{"header": '"${header}"', "protected": "'"${protected64}"'", "payload": "'"${payload64}"'", "signature": "'"${signed64}"'"}'
@@ -310,11 +317,11 @@
 extract_altnames() {
   csr="${1}" # the CSR itself (not a file)
 

   rm -f "${tmp_openssl_cnf}"
 
   crt_path="${BASEDIR}/certs/${domain}/cert-${timestamp}.pem"
@@ -540,9 +547,9 @@
   # Create fullchain.pem
   echo " + Creating fullchain.pem..."
   cat "${crt_path}" > "${BASEDIR}/certs/${domain}/fullchain-${timestamp}.pem"
