What is ACME?
ACME, the Automatic Certificate Management Environment, is a protocol that lets software request certificates from a certificate authority without anyone filling in order forms. The Internet Security Research Group created it for Let's Encrypt, which began issuing free certificates in 2015, and the IETF standardized it as RFC 8555 in 2019. Many public CAs and internal PKI products now accept ACME, and clients such as Certbot, acme.sh, win-acme and cert-manager for Kubernetes, along with web servers such as Caddy, run it on a schedule.
How an ACME request works
- The client creates an account key pair and registers it with the CA. Every later request is signed with that account key.
- It places an order listing the domain names it wants.
- The CA returns a challenge for each name, which the client must complete to prove control.
- Once the challenges pass, the client sends a CSR for a key pair it generated locally, and the CA issues the certificate.
- The client installs the certificate and repeats the cycle well before expiry.
As with a manual request, the certificate's private key never leaves the server.
The challenge types
| Challenge | How control is proved | Notes |
|---|---|---|
| HTTP-01 | Serve a token file under /.well-known/acme-challenge/ on port 80 | Simple; can't be used for wildcards |
| DNS-01 | Publish a TXT record at _acme-challenge under the domain | Works for wildcards and for servers the internet can't reach; needs DNS update access |
| TLS-ALPN-01 | Answer a special TLS handshake on port 443 with a validation certificate | Useful when port 80 is closed |
A DNS-01 record for example.com looks like this in the zone: _acme-challenge.example.com. 300 IN TXT "gfj9Xq...Rg85nM". A typical client run for a web server is certbot --nginx -d example.com -d www.example.com, and certbot renew --dry-run tests that scheduled renewal will succeed.
Why automation matters more every year
Public TLS certificate lifetimes are shrinking. Under a CA/Browser Forum ballot adopted in 2025, the maximum fell to 200 days in March 2026 and is scheduled to drop to 100 days in 2027 and 47 days in 2029, with shorter periods for reusing domain validation as well. Renewing hundreds of certificates by hand every few weeks isn't realistic, and expired certificates are among the most common avoidable outages. ACME turns renewal into a routine background job. It also makes rapid replacement practical: if a CA has to revoke certificates in bulk, ACME-managed servers can obtain new ones within hours.
Securing ACME
- Protect the account key and DNS credentials. DNS-01 needs a token that can edit DNS records, which in the wrong hands can redirect the whole domain. Scope tokens narrowly, or delegate _acme-challenge through a CNAME to a separate zone used only for validation.
- Restrict issuance with CAA. CAA records name the CAs allowed to issue for a domain, and the accounturi parameter from RFC 8657 can limit issuance to one specific ACME account.
- Watch what gets issued. Certificate Transparency logs show every public certificate for your names, including any requested through an ACME account you don't control.
- Keep expiry alerts. A renewal job that fails silently still causes an outage, so monitoring stays in place after automation.
ACME vs. manual CSRs, SCEP and EST
In a manual workflow an administrator generates a CSR, submits it through a portal and installs the result, which is fine for a few long-lived certificates. ACME automates the whole cycle for servers that must prove domain control. SCEP and EST are enrollment protocols aimed at devices: MDM platforms and network equipment commonly use SCEP to enroll phones, laptops and routers with an internal CA, and EST (RFC 7030) does the same job over TLS.
ACME on the CompTIA Security+ exam
ACME is taught with CSR generation and the certificate life cycle under SY0-801 objective 1.3, the cryptographic solutions objective. Wording such as "certificates keep expiring and causing outages", "certificate lifetimes are getting shorter" or "automate issuance and renewal of domain-validated certificates" points to automated renewal through ACME, backed by expiry monitoring. Distractors include buying a certificate with a longer lifetime, which public CAs no longer offer, switching to self-signed certificates, and wildcard certificates, which reduce the number of certificates but not the renewal workload.