What Is ACME Protocol? How Automated Certificate Issuance Works

Executive summary — For years, getting a TLS certificate meant a manual ritual: generate a request, submit it, prove you owned the domain, wait, download the certificate, install it, and set a reminder to do it all again before it expired. ACME automated that ritual out of existence, and in doing so quietly became one of the most important protocols on the internet.

ACME stands for Automatic Certificate Management Environment. It is a standard, published as RFC 8555, that lets a piece of software request, validate, obtain and renew certificates from a certificate authority with no human involvement. If you have ever set up a website whose certificate 'just renews itself', ACME is almost certainly the reason. It began in the web-PKI world but has become central to how enterprises manage certificates at scale.

The problem ACME solves

The manual certificate process had two chronic failures: it was slow, and it depended on someone remembering to renew. Both get worse as certificates multiply and lifetimes shrink. With maximum TLS certificate lifetimes falling to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029, a manual process that renews once a year becomes a process that renews many times a year — and each manual step is a chance to forget one and cause an outage. ACME removes the human from the loop entirely, which is the only realistic way to survive shortening lifetimes, as eMudhra's guide to certificate sprawl explains.

How the protocol actually works

The flow is a short, well-defined conversation. First, a client (software running on your server) creates an account with the certificate authority and generates a key pair. When it needs a certificate, it asks the CA, which responds with a challenge to prove control of the domain. The client answers the challenge — typically by placing a specific file on the web server or a specific record in DNS — and the CA checks it. Once control is proven, the client submits a certificate signing request and the CA issues the certificate. The client installs it automatically, and repeats the whole cycle before expiry. No emails, no downloads, no reminders.

The challenge types, briefly

ACME proves domain control through challenges, and the two common ones suit different situations. The HTTP challenge asks the client to serve a specific file over the web, which is simple and works well for public web servers. The DNS challenge asks the client to publish a specific DNS record, which is more flexible — it can validate wildcard certificates and works for systems that are not publicly reachable over HTTP. Choosing the right challenge type is most of the practical work of an ACME deployment.

Bringing ACME automation to your whole certificate estate? CertiNext CLM runs ACME alongside API and agent-based issuance across public and private CAs. See it in action.

ACME inside the enterprise

ACME is not only for public websites. Enterprises increasingly run internal ACME against their own private certificate authorities, so that internal services, load balancers and workloads get the same hands-free issuance and renewal that public web servers enjoy. This matters because internal certificates cause a disproportionate share of expiry outages, precisely because they are managed less carefully than public ones. Extending ACME inward — often through a lifecycle platform that speaks ACME to many CAs at once — is how organisations bring the messy internal estate under the same discipline. The practical playbook is set out in eMudhra's guide to automated certificate renewal with ACME.

Where ACME fits in the bigger picture

ACME solves issuance and renewal beautifully, but it is one capability, not a whole strategy. It does not, by itself, discover the certificates you have forgotten, map what depends on them, or manage the certificates on systems that cannot run an ACME client. A complete approach uses ACME wherever an endpoint supports it and wraps it in discovery, inventory and monitoring for everything else. And because certificates ultimately authenticate services and machines, ACME automation connects directly to machine identity management, where the same automated issuance secures non-human identities across the estate.

Automate issuance across every certificate you own

eMudhra will help you deploy ACME across public and private CAs and wrap it in the discovery and monitoring that ACME alone does not provide. Explore CertiNext CLM or speak to a CLM architect.