# What Is ACME? Definition and Examples

> ACME is the IETF protocol, RFC 8555, that lets software automatically prove domain control to a CA and obtain, renew and revoke certificates.

Source: https://ssl.sh/glossary/acme/
Last updated: 2026-11-10

ACME (Automatic Certificate Management Environment) was developed for [Let's Encrypt](https://ssl.sh/glossary/let-s-encrypt/) and standardized as [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555) in 2019. A client registers an account key, creates an order for one or more identifiers, completes a challenge for each authorization ([HTTP-01](https://ssl.sh/glossary/http-01/), DNS-01 or TLS-ALPN-01), sends a CSR to finalize the order and downloads the certificate chain. Every request is a JWS signed with the account key.

## Why it matters
ACME turned certificates from a yearly manual chore into a background task, and that is what makes shorter lifetimes workable. Under Ballot SC-081v3, maximum validity drops to 200 days from 2026-03-15, 100 days from 2027-03-15 and 47 days from 2029-03-15, while DCV reuse shrinks to 10 days, a pace no one can sustain by hand. Many CAs besides Let's Encrypt offer ACME, often requiring [External Account Binding](https://ssl.sh/glossary/eab/). Extensions such as ARI (RFC 9773) and certificate profiles build on the same protocol.

## Example
```bash
# Certbot, webroot mode
certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

# acme.sh, same idea
acme.sh --issue -d example.com -d www.example.com -w /var/www/html
```

The Let's Encrypt production directory is https://acme-v02.api.letsencrypt.org/directory; every ACME CA publishes a directory URL like this.

## Common misconceptions
- **ACME means Let's Encrypt.** It is an open IETF standard implemented by many free and commercial CAs.
- **The ACME client must run on the web server.** With DNS-01 and a DNS API token, a separate machine can obtain certificates and deploy them elsewhere.
- **Once ACME is set up, renewal cannot fail.** DNS changes, firewalls or rate limits can still break renewal, so monitor certificate expiry.

## Related terms

- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [TLS-ALPN-01](https://ssl.sh/zh/glossary/tls-alpn-01/): TLS-ALPN-01 是一种 ACME 验证方式，服务器在 443 端口针对 acme-tls/1 协议出示一张特殊证书来证明域名控制权。
- [EAB](https://ssl.sh/zh/glossary/eab/): EAB 即外部账户绑定，是 ACME 的一项功能，用 CA 提供的密钥 ID 和 HMAC 密钥把新 ACME 账户关联到你在该 CA 的已有客户账户。
- [ARI](https://ssl.sh/zh/glossary/ari/): ARI 是 ACME 的扩展标准（RFC 9773），由 CA 告诉客户端某张证书应该在哪个时间窗口内续期。
- [ACME Profile](https://ssl.sh/zh/glossary/acme-profile/): ACME Profile 是 CA 在 ACME 目录中公布的命名证书模板，客户端下单时选择它来决定证书的有效期和内容。
- [证书续期](https://ssl.sh/zh/glossary/certificate-renewal/): 证书续期是在证书到期前申请一张新证书来替换它，最好全自动完成并同时更换密钥对。