It's an "X.509 certificate" rather than a "TLS certificate".

As pointed out by sthen@, TLS isn't the only possible use.
From Ross L Richardson
ok shten@

diff --git a/usr.sbin/acme-client/acme-client.1 b/usr.sbin/acme-client/acme-client.1
index d57d173..275e8d2 100644 (file)
--- a/usr.sbin/acme-client/acme-client.1
+++ b/usr.sbin/acme-client/acme-client.1
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: acme-client.1,v 1.25 2018/08/02 14:37:32 benno Exp $
+.\"    $OpenBSD: acme-client.1,v 1.26 2018/08/02 14:39:26 benno Exp $
 .\"
 .\" Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv>
 .\"
@@ -56,7 +56,7 @@ The domain name.
 looks in its configuration for a
 .Ar domain
 section corresponding to the domain given as command line argument.
-It then uses that configuration to retrieve a TLS certificate.
+It then uses that configuration to retrieve an X.509 certificate.
 If the certificate already exists and is less than 30 days from expiry,
 .Nm
 will attempt to refresh the signature.