# What Is ACME Profile (ACME certificate profile)?

> An ACME profile is a named certificate template a CA advertises in its ACME directory, letting the client choose lifetime and contents per order.

Source: https://ssl.sh/glossary/acme-profile/
Last updated: 2026-11-10

An ACME profile is an extension to [ACME](https://ssl.sh/glossary/acme/): the CA lists its available profiles, each with a short description, under meta.profiles in its directory, and the client adds a profile field to its newOrder request. Let's Encrypt announced its profiles on 2025-01-09: classic (the default), tlsserver and shortlived. The shortlived profile issues six-day (160-hour) certificates; these, and [IP address certificates](https://ssl.sh/glossary/ip-address-certificate/) through the same profile, became generally available on 2026-01-15.

## Why it matters
Profiles let a CA change certificate contents without surprising every client at once. Let's Encrypt's 45-day plan, announced by ISRG on 2025-12-02, relies on them: the tlsserver profile has issued 45-day certificates since 2026-05-13, while the default classic profile moves to 64 days with 10-day authorization reuse from 2027-02-10, then to 45 days with 7-hour authorization reuse from 2028-02-16. Profiles also carried the end of client authentication: the classic profile stopped including the clientAuth [EKU](https://ssl.sh/glossary/extended-key-usage/) on 2026-02-11, and the tlsclient profile was discontinued on 2026-07-08.

## Example
List the profiles Let's Encrypt offers, then request one in a new order:

```bash
curl -s https://acme-v02.api.letsencrypt.org/directory | jq .meta.profiles
```

```json
{
  "identifiers": [{ "type": "dns", "value": "example.com" }],
  "profile": "tlsserver"
}
```

Clients that support profiles expose this as an option; others keep receiving the default classic profile.

## Common misconceptions
- **The profile is chosen in the CSR.** It is a field of the ACME order; the CSR only supplies the key and names.
- **The default profile will always issue today's lifetime.** Under the published plan, classic shrinks to 64 days from 2027-02-10 and to 45 days from 2028-02-16.
- **Short-lived certificates still need OCSP or CRL pointers.** Under Ballot SC-063, certificates of 7 days or less issued from 2026-03-15 need not carry them; their short life is the protection.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [IP 证书](https://ssl.sh/zh/glossary/ip-address-certificate/): IP 证书是在 SAN 中写入 IP 地址的 TLS 证书，使客户端在直接通过 IP 访问服务器时也能验证其身份。
- [有效期](https://ssl.sh/zh/glossary/validity-period/): 有效期是证书中 notBefore 与 notAfter 两个时间之间的区间，只有在此区间内客户端才会接受这张证书。
- [EKU](https://ssl.sh/zh/glossary/extended-key-usage/): EKU 即扩展密钥用途，是列出证书可用于哪些目的（如 serverAuth 服务器认证、clientAuth 客户端认证、代码签名）的 X.509 扩展。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。