Automatic Certificate Management Environment

Automatic Certificate Management Environment (ACME) is an IETF standards-track protocol used to automate the issuance, renewal, and revocation of Web PKI certificates by coordinating domain control validation and certificate delivery between a Certification Authority and an automated client. ACME became widely deployed through services such as Let’s Encrypt, which use ACME-based automation to provide domain-validated TLS certificates at scale.

Origins

ACME was developed to reduce the cost and operational friction of certificate management by standardising an automated CA-to-client interface. The protocol was standardised by the IETF as RFC 8555 in 2019.

ACME is designed to be extensible. Additional RFCs define new validation methods and identifier types, including the TLS ALPN-based challenge extension (RFC 8737) and issuance for IP address identifiers (RFC 8738).

Operation (High-Level)

ACME uses HTTPS requests carrying JSON objects to manage certificate lifecycles. A typical flow is:

• The client establishes an ACME account (identified by an account key).
• The client requests an order for one or more identifiers (usually DNS names).
• The CA issues one or more authorizations containing challenges that prove control over the identifier.
• After successful validation, the CA issues a certificate and the client deploys it and renews it periodically.

Common validation mechanisms include:

• HTTP-01: proving control by serving a token under a well-known path on the web server.
• DNS-01: proving control by publishing a DNS TXT record.
• TLS-ALPN-01: proving control through a specific TLS handshake behaviour (defined as an ACME extension).

Considerations

Automation

As certificate validity periods and revalidation rules tighten, ACME-style automation becomes less optional for many operators. The CA/Browser Forum has adopted policy changes that introduce staged reductions in certificate lifetimes and in the permitted reuse period for domain-control validation data, increasing the frequency of renewal and revalidation events across the ecosystem.

Security baseline

By lowering the marginal cost of HTTPS deployment and renewal, ACME supports the broader shift toward ubiquitous encryption on the web. While ACME does not change DNS or TLS semantics directly, the practical outcome of large-scale automated certificate issuance is an Internet where on-path inspection and modification of HTTP traffic is increasingly difficult, pushing control and visibility toward endpoints and platforms rather than access networks.

Abuse controls

High-volume automated issuance creates incentives for rate limiting and other anti-abuse controls at CA scale. Let’s Encrypt, for example, documents rate limits and related operational constraints that shape how automation is engineered by large hosting platforms and resellers.

See Also

• Web PKI

Internet Engineering Task Force

X.509 Public Key Infrastructure for the Internet (RFC 5280).

Allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery (RFC 8446).

Request For Comments. Archival series dedicated to documenting Internet technical specifications, including general contributions from the Internet research and engineering community as well as standards documents (RFC Editor Model, Version 3).

HTTP over Transport Layer Security (TLS), distinguishing secured traffic from insecure traffic by the use of a different server port (RFC 2818).

Hypertext Transfer Protocol. Application-level protocol for distributed, collaborative, hypermedia information systems (RFC 2616).