According to code (and testing), each is optional but at least one must be present.
Index: acme-client.conf.5 =================================================================== RCS file: /cvs/src/usr.sbin/acme-client/acme-client.conf.5,v retrieving revision 1.13 diff -u -p -r1.13 acme-client.conf.5 --- acme-client.conf.5 8 Jul 2018 15:41:17 -0000 1.13 +++ acme-client.conf.5 2 Aug 2018 04:33:57 -0000 @@ -120,6 +120,9 @@ plain domain name forms. The private key file for which the certificate will be obtained. .It Ic domain certificate Ar file The filename of the certificate that will be issued. +This is optional if +.Ar domain full chain certificate +is specified. .It Ic domain chain certificate Ar file The filename in which to store the certificate chain that will be returned by the certificate authority. @@ -137,6 +140,9 @@ This is a combination of the and the .Ar domain chain certificate in one file, and is required by most browsers. +This is optional if +.Ar domain certificate +is specified. .It Ic sign with Ar authority The certificate authority (as declared above in the .Sx AUTHORITIES
