ACME (Automatic Certificate Management Environment) is a protocol defined in RFC 8555 that automates the entire lifecycle of SSL/TLS certificate management—from domain validation and certificate issuance through renewal and revocation. It eliminates manual certificate request workflows by allowing clients and servers to communicate directly with a Certificate Authority to obtain trusted SSL certificates.
The protocol works by having a client prove control over a domain through a challenge (typically HTTP-01, DNS-01, or TLS-ALPN-01), then requesting a signed certificate. All communication happens over HTTPS using JSON messages signed as JWS (JSON Web Signature). Once validated, the client receives the certificate and can renew it automatically before expiry. Major CAs like Let's Encrypt use ACME to issue certificates at scale.
How challenges work:
| Challenge | Method | Use case |
|---|---|---|
| HTTP-01 | Serve a file via HTTP on port 80 | Web servers with public HTTP access |
| DNS-01 | Create a DNS TXT record | Wildcard certs, internal services, CDNs |
| TLS-ALPN-01 | Respond to TLS extension on port 443 | Servers without HTTP, no DNS access |
ACME powers most free and commercial HTTPS deployments today. A typical client (like Certbot) runs on your server, talks to the CA via ACME, proves domain ownership, fetches the certificate, and schedules automatic renewal—all without manual intervention.
TipMost Certificate Authorities supporting ACME also support CAA records, which you should configure to restrict which CAs can issue certificates for your domain.
Use /tools/ssl-check to verify your certificate is valid and properly renewed.