When getting started it's probably better to use the --staging (-s)
option. This is designed for testing.
uacme hardcodes the configuration directory to /etc/ssl/uacme. Most of us
use the libc path rewriter which with default settings will map this path
to %ETC/ssl/uacme.
Perhaps the next build should use /@unixroot/etc/ssl rather than /etc/ssl?
This generally works better with apps built against kLIBC?
FWIW, I have implmented a mostly tested and working ucame-hook.cmd. It's
sufficiently generic that one script should work for all domains on a
given system.