ACME (Automatic Certificate Management Environment, RFC 8555) is the protocol a client uses to request, validate, issue, renew and revoke TLS certificates from a certificate authority without human steps. Let's Encrypt made it widely known, and many other CAs now support it.
Why it matters
ACME makes short-lived certificates practical. A client such as certbot, acme.sh, Caddy or a cloud load balancer registers an account, asks for a certificate, completes a challenge to show it controls the domain, and then installs the result. Renewal repeats the same flow on a timer, so expiry outages mostly disappear.
When automation breaks, it is usually because the challenge cannot be completed: a firewall blocks port 80, DNS credentials expired, or a redirect interferes.
Example
certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com
certbot renew --dry-runThe --dry-run command exercises the renewal path against the staging environment without issuing real certificates, so run it after any server change.
Common mistakes
- Setting up issuance but never testing renewal.
- Hitting CA rate limits by repeatedly requesting production certificates while debugging. Use staging.
- Assuming automation means no monitoring. Watch expiry independently.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.