# acme

Source: https://startwithidentity.com/glossary/acme/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

ACME (Automated Certificate Management Environment) is the IETF protocol, [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555) (March 2019, Proposed Standard), that lets a server request, renew and revoke X.509 certificates from a certificate authority with no human in the loop, proving control of the domain through a challenge such as `http-01` or `dns-01`. It is what most people mean by automated certificate management.

A client (certbot, cert-manager in Kubernetes, or a web server's built-in client) creates an account key, places an order for a domain, answers the CA's challenge by publishing a token at a well-known HTTP path or in a DNS TXT record, then submits a certificate signing request and downloads the certificate. Renewal repeats the same steps on a schedule. [Let's Encrypt](https://startwithidentity.com/vendors/pki/lets-encrypt/), which helped standardize the protocol, issues certificates only through ACME; commercial CAs such as [DigiCert](https://startwithidentity.com/vendors/pki/digicert/) and [Sectigo](https://startwithidentity.com/vendors/pki/sectigo/) and private CAs such as [Smallstep](https://startwithidentity.com/vendors/pki/smallstep/) also support it.

| Challenge | How control is proven | Fits |
|---|---|---|
| `http-01` | File served on port 80 of the domain | Single public web servers |
| `dns-01` | TXT record in the domain's DNS | Wildcards, internal hosts, load balancers |

It matters more every year because certificate lifetimes are shrinking. Under CA/Browser Forum [Ballot SC-081v3](https://cabforum.org/2025/04/11/ballot-sc081v3-introduce-schedule-of-reducing-validity-and-data-reuse-periods/), public TLS certificates have been capped at 200 days since March 15, 2026, falling to 100 days in 2027 and 47 days from March 15, 2029. At 47 days, renewing by ticket is not workable. ACME solves issuance and renewal, not inventory: you still need [certificate lifecycle management](https://startwithidentity.com/glossary/certificate-lifecycle/) to find certificates nobody automated, and protection for the `dns-01` API credentials, which can issue certificates for the whole domain.

See also: [certificate authority](https://startwithidentity.com/glossary/certificate-authority/), [PKI](https://startwithidentity.com/glossary/pki/), [X.509](https://startwithidentity.com/glossary/x509/), [certificate lifecycle management guide](https://startwithidentity.com/guides/machine-identity/certificate-lifecycle-management-guide/), [open-source PKI and certificate management tools](https://startwithidentity.com/articles/top-6-open-source-pki-certificate-management-tools/)