Comment by emersion

ACME clients should write the private key and certificate to a temporary file, then move it to the final destination so that the change is atomic.