Cybersecurity glossary
What is Automated Certificate Management Environment (ACME)?
Learn what ACME is, how HTTP-01 and DNS-01 validation prove domain control, why short-lived certificates need automation, and how to operate ACME safely.
Definition
Automated Certificate Management Environment (ACME) is a protocol for automating certificate issuance and renewal—popularized by Let’s Encrypt—where a client proves control of identifiers such as domain names to a CA and receives X.509 certificates without manual CSR ticket workflows.
Why certificate automation became mandatory
Manual certificate tickets do not scale to microservices and multi-cloud hostnames. ACME turned domain validation and issuance into machine-readable workflows so short-lived HTTPS certificates can renew before users see warnings.
ACME building blocks
ACME client
Software such as certbot or built-in platform integrations that speak the protocol.
ACME server / CA
The authority that verifies challenges and issues certificates.
Challenges
HTTP-01, DNS-01, or TLS-ALPN-01 proofs of identifier control.
Certificate private key
Generated by the client and never sent to the CA.
Typical ACME issuance flow
Create or use an ACME account
Client authenticates with its account key.
Submit an order for names
Requested identifiers become certificate SANs if validated.
Complete challenges
Prove HTTP or DNS control for each name.
Finalize with a CSR
Client proves possession of the certificate key.
Download and install
Automate deployment to load balancers or hosts.
Renew before expiry
Repeat validation and replace certificates on a schedule.
Choosing an ACME challenge
Pick the challenge that matches your network and naming needs.
| Challenge | Good for | Watch out |
|---|---|---|
| HTTP-01 | Simple web servers with port 80 reachable | Fails if HTTP is blocked or multi-CDN routing is messy |
| DNS-01 | Wildcards and hosts without public HTTP | DNS API credentials become high-value secrets |
| TLS-ALPN-01 | TLS-capable endpoints without DNS API access | Needs correct TLS listener support |
Operational checklist
- Monitor certificate expiry independently of the ACME client’s success logs.
- Store ACME account keys and certificate private keys with least privilege.
- Scope DNS-01 API tokens to the minimum zones and record permissions.
- Test renewals in staging (including staging ACME directories) before production cutover.
- Ensure load balancers receive full chains after automated install.
- Alert when challenge failures repeat—DNS or HTTP path regressions are common.
- Document who owns each hostname’s ACME automation.
- Plan rate-limit handling so burst reissues cannot lock you out during incidents.
Automation without observability still expires
ACME removes human toil but not operational ownership. The failure mode shifts from “someone forgot to buy a cert” to “the cron job silently failed for three weeks.” Expiry dashboards remain mandatory.
The practical takeaway
ACME automates proving domain control and issuing TLS certificates so short lifetimes stay practical. Choose appropriate challenges, protect account and DNS credentials, and monitor renewals as a first-class reliability signal.
Related security terms
Certificate Authority (CA)
ACME clients automate enrollment against ACME-enabled CAs.
Certificate Signing Request (CSR)
Still used under the hood when requesting certificate issuance.
Subject Alternative Name (SAN)
ACME orders request specific DNS names that appear as SANs.
HTTPS
ACME exists largely to keep HTTPS certificates valid continuously.
Certificate Transparency
Publicly trusted ACME-issued certs are typically logged to CT.
Frequently asked questions
What is ACME in simple terms?
ACME is an API standard that lets software prove you control a domain and automatically fetch TLS certificates from a certificate authority.
What are HTTP-01 and DNS-01?
Validation methods. HTTP-01 serves a challenge token over HTTP; DNS-01 places a challenge token in a DNS TXT record—useful for wildcards and locked-down hosts.
Why do ACME certificates expire quickly?
Short lifetimes reduce abuse windows and force automation. Ninety-day lifetimes are common in public ACME services.
Is ACME only for Let’s Encrypt?
No. Let’s Encrypt popularized it, but other CAs also offer ACME endpoints.
What is an ACME account key?
A key pair identifying the ACME client account to the CA for order management—not the same as the certificate private key.
Can ACME issue wildcard certificates?
Often yes via DNS-01 validation, depending on CA policy.
What are the main ACME operational risks?
Broken renewal automation, exposed account keys, overly broad DNS API credentials for DNS-01, and missed monitoring of expiry.
References
Explore authoritative guidance and frameworks related to automated certificate management environment (acme).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.