DE EN IT

~/glossary / Web & TLS

ACME

ACME (Automatic Certificate Management Environment) is the protocol for requesting, validating and renewing certificates automatically, best known from Let's Encrypt.

daniele@mikweb: ~/glossary — man acme

An ACME client such as certbot, acme.sh, Caddy or Traefik proves control of the domain to the CA. With HTTP-01 it places a file under /.well-known/acme-challenge/ that the CA fetches over port 80. With DNS-01 it creates a TXT record _acme-challenge, which also allows wildcard certificates.

Let's Encrypt certificates are valid for 90 days, so renewal must run automatically, via a systemd timer or cron, including a reload of the web server, which otherwise keeps serving the old certificate.

Common reasons for failed renewals: port 80 blocked by a firewall, a redirect that catches /.well-known/, a CAA record that does not allow the CA, or rate limits after too many failed attempts.

Example

certbot renew --dry-run
daniele@mikweb: ~/glossary — ls

Related terms

Certificate chainA certificate chain is the sequence of server certificate, one or more intermediate certificates and the root CA that a client uses to verify authenticity.CAA recordA CAA record states in DNS which certificate authorities (CAs) are allowed to issue TLS certificates for a domain.SAN (Subject Alternative Name)The SAN (Subject Alternative Name) is the TLS certificate field that lists all hostnames, and optionally IP addresses, the certificate is valid for.TXT recordA TXT record stores arbitrary text for a DNS name and is used mostly for email authentication and ownership checks.

← All terms