diff --git a/bin/letsencrypt.js b/bin/letsencrypt.js
index 603592f..13eb9c4 100755
--- a/bin/letsencrypt.js
+++ b/bin/letsencrypt.js
@@ -81,11 +81,11 @@ cli.main(function(_, options) {
     var handlers;
     
     if (args.standalone) {
-      handlers = require('../lib/standalone');
+      handlers = require('../lib/standalone').create();
       handlers.startServers(args.http01Ports || [80], args.tlsSni01Port || [443, 5001]);
     }
     else if (args.webrootPath) {
-      handlers = require('../lib/webroot');
+      handlers = require('../lib/webroot').create(args);
     }
 
     LE.create({}, handlers).register(args, function (err, results) {
diff --git a/lib/standalone.js b/lib/standalone.js
index 5f4ecb6..5191ce4 100644
--- a/lib/standalone.js
+++ b/lib/standalone.js
@@ -1,62 +1,69 @@
 'use strict';
 
-var handlers = module.exports = {
-  //
-  // set,get,remove challenges
-  //
-  _challenges: {}
-, setChallenge: function (args, key, value, cb) {
-    handlers._challenges[key] = value;
-    cb(null);
-  }
-, getChallenge: function (args, key, cb) {
-    cb(null, handlers._challenges[key]);
-  }
-, removeChallenge: function (args, key, cb) {
-    delete handlers._challenges[key];
-    cb(null);
-  }
-
-, _servers: []
-, httpResponder: function (req, res) {
-    var acmeChallengePrefix = '/.well-known/acme-challenge/';
-
-    if (0 !== req.url.indexOf(acmeChallengePrefix)) {
-      res.end('Hello World!');
-      return;
+var handlers = module.exports.create = function () {
+  return {
+    //
+    // set,get,remove challenges
+    //
+    // Note: this is fine for a one-off CLI tool
+    // but a webserver using node-cluster or multiple
+    // servers should use a database of some sort
+    _challenges: {}
+  , setChallenge: function (args, key, value, cb) {
+      handlers._challenges[key] = value;
+      cb(null);
+    }
+  , getChallenge: function (args, key, cb) {
+      // TODO keep in mind that, generally get args are just args.domains
+      // and it is disconnected from the flow of setChallenge and removeChallenge
+      cb(null, handlers._challenges[key]);
+    }
+  , removeChallenge: function (args, key, cb) {
+      delete handlers._challenges[key];
+      cb(null);
     }
 
-    var key = req.url.slice(acmeChallengePrefix.length);
+  , _servers: []
+  , httpResponder: function (req, res) {
+      var acmeChallengePrefix = '/.well-known/acme-challenge/';
 
-    handlers.getChallenge(req.headers.host, key, function (err, val) {
-      res.end(val || '_');
-    });
-  }
-, startServers: function (plainPorts, tlsPorts) {
-    var httpsOptions = require('localhost.daplie.com-certificates');
-    var https = require('https');
-    var http = require('http');
+      if (0 !== req.url.indexOf(acmeChallengePrefix)) {
+        res.end('Hello World!');
+        return;
+      }
 
-    // tls-sni-01-port
-    if (handlers._servers.length) {
-      return;
+      var key = req.url.slice(acmeChallengePrefix.length);
+
+      handlers.getChallenge(req.headers.host, key, function (err, val) {
+        res.end(val || '_');
+      });
     }
+  , startServers: function (plainPorts, tlsPorts) {
+      var httpsOptions = require('localhost.daplie.com-certificates');
+      var https = require('https');
+      var http = require('http');
 
-    plainPorts.forEach(function (port) {
-      http.createServer(handlers.httpResponder).listen(port, function () {
-        console.info('Listening http on', this.address());
+      // tls-sni-01-port
+      if (handlers._servers.length) {
+        return;
+      }
+
+      plainPorts.forEach(function (port) {
+        http.createServer(handlers.httpResponder).listen(port, function () {
+          console.info('Listening http on', this.address());
+        });
       });
-    });
-    tlsPorts.forEach(function (port) {
-      https.createServer(httpsOptions, handlers.httpResponder).listen(port, function () {
-        console.info('Listening https on', this.address());
+      tlsPorts.forEach(function (port) {
+        https.createServer(httpsOptions, handlers.httpResponder).listen(port, function () {
+          console.info('Listening https on', this.address());
+        });
       });
-    });
-  }
-, closeServers: function () {
-    handlers._servers.forEach(function (server) {
-      server.close();
-    });
-    handlers._servers = [];
-  }
+    }
+  , closeServers: function () {
+      handlers._servers.forEach(function (server) {
+        server.close();
+      });
+      handlers._servers = [];
+    }
+  };
 };
diff --git a/lib/webroot.js b/lib/webroot.js
index e69de29..8f37ae6 100644
--- a/lib/webroot.js
+++ b/lib/webroot.js
@@ -0,0 +1,51 @@
+'use strict';
+
+var handlers = module.exports.create = function (defaults) {
+  var fs = require('fs');
+  var path = require('path');
+  var mkdirp = require('mkdirp');
+
+  return {
+    //
+    // set,get,remove challenges
+    //
+    _challenges: {}
+  , setChallenge: function (args, key, value, cb) {
+      mkdirp(defaults.webrootPath, function (err) {
+        if (err) {
+          console.error("Could not create --webroot-path '" + defaults.webrootPath + "':", err.code);
+          console.error("Try checking the permissions, maybe?");
+          cb(err);
+          return;
+        }
+
+        var keyfile = path.join(defaults.webrootPath, key);
+
+        fs.writeFile(keyfile, value, 'utf8', function (err) {
+          if (err) {
+            console.error("Could not write '" + keyfile + "':", err.code);
+            cb(err);
+            return;
+          }
+
+          cb(null);
+        });
+      });
+    }
+  // handled as file read by web server
+  // , getChallenge: function (args, key, cb) {}
+  , removeChallenge: function (args, key, cb) {
+      var keyfile = path.join(defaults.webrootPath, key);
+
+      fs.unlink(keyfile, function (err) {
+        if (err) {
+          console.error("Could not unlink '" + keyfile + "':", err.code);
+          cb(err);
+          return;
+        }
+
+        cb(null);
+      });
+    }
+  };
+};