中文

Glossary

ACME (Automatic Certificate Management Environment)

Last verified

Definition

ACME is the IETF protocol, RFC 8555, that lets software automatically prove domain control to a CA and obtain, renew and revoke certificates.

ACME (Automatic Certificate Management Environment) was developed for Let's Encrypt and standardized as RFC 8555 in 2019. A client registers an account key, creates an order for one or more identifiers, completes a challenge for each authorization (HTTP-01, DNS-01 or TLS-ALPN-01), sends a CSR to finalize the order and downloads the certificate chain. Every request is a JWS signed with the account key.

Why it matters

ACME turned certificates from a yearly manual chore into a background task, and that is what makes shorter lifetimes workable. Under Ballot SC-081v3, maximum validity drops to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, while DCV reuse shrinks to 10 days, a pace no one can sustain by hand. Many CAs besides Let's Encrypt offer ACME, often requiring External Account Binding. Extensions such as ARI (RFC 9773) and certificate profiles build on the same protocol.

Example

# Certbot, webroot mode
certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

# acme.sh, same idea
acme.sh --issue -d example.com -d www.example.com -w /var/www/html

The Let's Encrypt production directory is https://acme-v02.api.letsencrypt.org/directory; every ACME CA publishes a directory URL like this.

Common misconceptions

  • ACME means Let's Encrypt. It is an open IETF standard implemented by many free and commercial CAs.
  • The ACME client must run on the web server. With DNS-01 and a DNS API token, a separate machine can obtain certificates and deploy them elsewhere.
  • Once ACME is set up, renewal cannot fail. DNS changes, firewalls or rate limits can still break renewal, so monitor certificate expiry.

See also