ACME (Automated Certificate Management Environment)
ACME (Automated Certificate Management Environment) is the IETF protocol, RFC 8555 (March 2019, Proposed Standard), that lets a server request, renew and revoke X.509 certificates from a certificate authority with no human in the loop, proving control of the domain through a challenge such as http-01 or dns-01. It is what most people mean by automated certificate management.
A client (certbot, cert-manager in Kubernetes, or a web server's built-in client) creates an account key, places an order for a domain, answers the CA's challenge by publishing a token at a well-known HTTP path or in a DNS TXT record, then submits a certificate signing request and downloads the certificate. Renewal repeats the same steps on a schedule. Let's Encrypt, which helped standardize the protocol, issues certificates only through ACME; commercial CAs such as DigiCert and Sectigo and private CAs such as Smallstep also support it.
| Challenge | How control is proven | Fits |
|---|---|---|
http-01 |
File served on port 80 of the domain | Single public web servers |
dns-01 |
TXT record in the domain's DNS | Wildcards, internal hosts, load balancers |
It matters more every year because certificate lifetimes are shrinking. Under CA/Browser Forum Ballot SC-081v3, public TLS certificates have been capped at 200 days since March 15, 2026, falling to 100 days in 2027 and 47 days from March 15, 2029. At 47 days, renewing by ticket is not workable. ACME solves issuance and renewal, not inventory: you still need certificate lifecycle management to find certificates nobody automated, and protection for the dns-01 API credentials, which can issue certificates for the whole domain.
See also: certificate authority, PKI, X.509, certificate lifecycle management guide, open-source PKI and certificate management tools
Related on Start with Identity
- BlogBrowsers block eight eMudhra intermediate CAs after their private keys are exposed
A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later
- GlossaryMachine Identity
A machine identity is the credential that lets a device, server, application or workload prove who it is to another system without a person signing in: most oft
- PodcastSectigo
Short, frequent episodes on PKI, certificate policy, and post-quantum migration from two certificate industry veterans at Sectigo. 670 episodes and counting.
- ArticleCertificate Lifecycle Management: What Breaks and How to Automate It
Certificate management explained: discovery, issuance, renewal, and revocation across public and private PKI, why the CA/Browser Forum schedule to 47-day certif
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio