What is ACME? How automatic certificate renewal works

Validation methods

http-01

The authority requests a specific file on port 80 of the domain. Simple, but not allowed for wildcards and it needs a publicly reachable HTTP endpoint.

dns-01

A TXT record is written under _acme-challenge. The only way for wildcards and for internal systems that are not reachable from outside; it needs DNS provider API access.

tls-alpn-01

Validation happens inside the TLS handshake on port 443 (RFC 8737). Limited use behind load balancers.

Renewal timing

• Rule of thumb: renew when about a third of the lifetime remains. 30 days before expiry for a 90-day certificate, roughly 15 days for a 47-day one.
• Avoid renewal storms: certificates issued on the same day renew on the same day; add a small random offset to the renewal time.
• ACME Renewal Information (RFC 9773): the authority publishes a suggested renewal window per certificate and can ask for early renewal during an incident.
• Authorities enforce rate limits; plan for them in large initial rollouts.

Which authorities offer ACME

Let's Encrypt

Free, domain-validated, 90-day certificates; the most widely used ACME authority.

Commercial authorities

Many commercial authorities offer ACME endpoints for enterprise accounts; organisation validation is attached to the account once and later issuances are automatic.

Internal PKI

Products such as Smallstep step-ca and HashiCorp Vault PKI offer ACME internally. Authorities that do not speak ACME leave manual or bridging processes.

What ACME does not cover

ACME obtains the certificate; it does not install it on the target, reload the service or verify the result. In an enterprise, the real work is in that second half.

• The certificate and key must be moved to the target securely; the private key should stay where it was generated.
• The service must be reloaded without downtime, and only after the configuration test passes.
• The target must be confirmed to actually serve the new certificate; on failure, roll back from the backup.
• Every step must be recorded.