What ACME is and how to automate your certificates
Renewing a certificate by hand is a task that comes round once a year, that everybody forgets, and that takes the site down when it fails. ACME removes it: your server asks for the certificate, proves it controls the domain, installs it and does the whole thing again before expiry, with nobody involved.
This article covers what it is, what you need and how to start.
What ACME is
ACME — Automatic Certificate Management Environment — is an IETF standard, RFC 8555. It belongs to nobody: it is the same protocol Let's Encrypt uses and the one certbot, acme.sh, Caddy, Traefik, cert-manager and nearly everything else speaks.
The exchange is always the same. Your client tells the authority which name it wants; the authority asks for proof that it controls that domain — a file on the web server, or a TXT record in DNS; the client publishes it, the authority checks it and issues. Then the client repeats the cycle on its own as expiry approaches.
The difference from Let's Encrypt is not the protocol, it is what stands behind the certificate: a warranty, organisation validation if you need it, support with a name attached, and issuance that does not depend on a free tier's rate limit.
The two mechanisms
Not everything automated speaks ACME. There are two roads, and it is worth knowing which one suits you:
AutoInstall. A tool that does the work for you: it generates the CSR, validates the domain, downloads the certificate, installs it on your Windows or Linux server and checks it landed. No protocol to learn, no client to configure. Available on the Plan + Automate certificates.
ACME. A client you already run speaks the protocol to the authority and renews without intervention. It is the road for infrastructure that moves, for containers, and for estates with many names. Available on every automated certificate, and the ACME Certificate-as-a-Service products work only this way.
What you need
Two things:
- An ACME client. You may already have one: certbot on Linux, acme.sh, Caddy and Traefik ship with it built in, cert-manager on Kubernetes, and several panels include it.
- EAB credentials. A key identifier and an HMAC key that bind your client to your account with the authority. We send them with the order, they are configured once and never touched again.
Let's Encrypt needs no credentials because anybody may ask. A commercial authority does: they are what says the certificate is issued against your account.
Getting started, with certbot
You register the client once:
certbot register \
--server <the ACME directory address> \
--eab-kid <your key id> \
--eab-hmac-key <your HMAC key>
And from then on you ask for certificates whenever you want:
certbot certonly --nginx -d yourdomain.com
The three values in <> travel in the activation email for your order. certbot schedules the renewal itself; on modern installations there is nothing to add to cron.
With acme.sh the registration is acme.sh --register-account --server <directory> --eab-kid <id> --eab-hmac-key <key>. With Caddy and Traefik it goes in their configuration file, and with cert-manager in a ClusterIssuer. The syntax changes, the procedure does not.
Why this matters now
Because certificate lifetimes are shrinking on an industry schedule: today the maximum is 200 days, from 15 March 2027 it will be 100, and from 15 March 2029, 47. That turns one renewal a year into four, and then into eight, for every certificate you hold.
By hand that does not hold. Automated it costs what it costs today, because the work is configuring the client once. We go through it in 47-day certificates: what changes and when.
Common questions
Does it do wildcards? Yes, validating over DNS instead of over a file. Your client needs to be able to create a TXT record in your zone, which is what the DNS plugins for certbot and acme.sh do.
Can I automate an OV or an EV? Issuance, yes. The organisation validation happens once and lasts, so the renewals after it come out automatic. Write to us and we will look at your case.
Do I have to generate a CSR? No. The client generates one at every issuance, with a fresh key. That rotation is another benefit: a leaked key lasts weeks, not years.
What if I already bought certificates? They migrate without waiting for expiry and without an interruption.
Where does it run? On anything that speaks ACME: nginx, Apache, IIS, cPanel, Plesk, Kubernetes, Docker, Caddy, Traefik, HAProxy.
Next step
Look at the automated certificates and which one suits you, or read the full explanation on the automation page. If you do not know where to start, tell us which server you run and how many domains you have.
