ACME (Automatic Certificate Management Environment, RFC 8555) is the protocol a client uses to request, validate, issue, renew and revoke TLS certificates from a certificate authority without human steps. Let's Encrypt made it widely known, and many other CAs now support it.
Why it matters
ACME makes short-lived certificates practical. A client such as certbot, acme.sh, Caddy or a cloud load balancer registers an account, asks for a certificate, completes a challenge to show it controls the domain, and then installs the result. Renewal repeats the same flow on a timer, so expiry outages mostly disappear.
When automation breaks, it is usually because the challenge cannot be completed: a firewall blocks port 80, DNS credentials expired, or a redirect interferes.
Example
certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com
certbot renew --dry-runThe --dry-run command exercises the renewal path against the staging environment without issuing real certificates, so run it after any server change.
Common mistakes
- Setting up issuance but never testing renewal.
- Hitting CA rate limits by repeatedly requesting production certificates while debugging. Use staging.
- Assuming automation means no monitoring. Watch expiry independently.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.