Skip to main content
MI Support IT logo

IT security

What is the ACME protocol?

ACME automates the issuance and renewal of TLS certificates, known from Let's Encrypt. See how the protocol works, and why it is becoming a requirement.

In short

ACME (Automatic Certificate Management Environment) is an open protocol, standardised as RFC 8555, that automates the issuance, validation and renewal of digital certificates.

The protocol became known through Let's Encrypt, which uses it to issue free TLS certificates to millions of websites without manual processing. In practice, an ACME client runs on your server, proves control over the domain via a so-called challenge and then retrieves the certificate automatically, typically renewing it long before expiry.

It is relevant to everyone who operates websites and services, because certificate lifetimes across the industry are being shortened dramatically, turning manual renewal into an operational risk rather than a routine task. The key points are: automation removes human error, ACME works with both public and internal CAs, and rollout requires a firm grip on DNS and infrastructure.

MI Support IT has many years of specialist experience with PKI and helps Danish businesses put ACME-based certificate automation into practice.

Back to the glossary

What is the ACME protocol?

ACME (Automatic Certificate Management Environment) is an open protocol, standardised in RFC 8555, that automates the entire process around digital certificates: ordering, domain validation, issuance and renewal. The protocol was developed for Let's Encrypt, which has used it to make free TLS certificates the standard on the web. The manual work, where an administrator orders, retrieves and installs certificates by hand, is replaced by a client that talks directly to a Certificate Authority and handles everything itself.

How does ACME work in practice?

The core of ACME is that the client must prove control over the domain before the CA issues a certificate. This happens via so-called challenges:

  1. HTTP-01: The CA asks the client to place a specific file at a specific address under the domain. If the CA can fetch the file, control is proven. Simple, but it requires the server to be reachable from the internet on port 80.
  2. DNS-01: The client creates a specific TXT record in the domain's DNS. This also works for internal servers and wildcard certificates, but requires the client to be able to update DNS automatically.

Once a challenge is passed, the CA issues the certificate and the client installs it. The whole process takes seconds and is repeated automatically, typically when a third of the lifetime remains.

Why has automatic renewal become necessary?

The maximum lifetime of certificates has been shortened in several rounds, and the industry is moving towards lifetimes so short that manual renewal is effectively impossible to operate reliably. A forgotten certificate means downtime, browser warnings and lost trust, and it typically hits on a Friday evening. We have described the entire journey from issuance to expiry in the article on the TLS certificate lifecycle. The point is simple: when renewal has to happen frequently and flawlessly, automation is no longer a convenient add-on but a prerequisite for stable operations.

ACME in the enterprise: more than Let's Encrypt

Many associate ACME with free certificates for public websites, but the protocol is vendor-neutral. Commercial CAs offer ACME endpoints, and internal CAs in a PKI can also speak ACME, for example via ACME services on top of Active Directory Certificate Services or dedicated PKI platforms (see Microsoft Learn for documentation of the certificate services). This means internal servers, load balancers and containers can renew their certificates just as automatically as a public website. Key protection belongs in this picture too: the CA's own keys should live in an HSM, so the automation rests on a secure foundation. If you want to dig deeper into how automated certificate management and key protection work together, we have collected it all in the e-book PKI and HSM in practice.

How MI Support IT can help

We have many years of specialist experience with enterprise PKI and certificate automation and help both SMBs and larger organisations adopt ACME, from choosing clients and CAs to monitoring renewals. Read more under PKI Management, or contact us for a conversation about your certificate operations.

Shall we talk about your business and your needs?

Real people talking to real people. We get back to you the same day.

Write to usBook a meeting