ACME in depth · 18.1

How ACME works

ACME (Automatic Certificate Management Environment, RFC 8555) is an open internet protocol. With ACME, software such as TLSPilot orders, renews and revokes certificates at a certification authority (CA) fully automatically. Instead of a person filling in a form, TLSPilot proves by itself that you control the domain, for example with a DNS entry or a file on the web server. Let’s Encrypt made ACME popular. Today, Google Trust Services, ZeroSSL, Sectigo, DigiCert and other CAs also offer ACME.

Simplified, ACME is an order with proof of identity. Every message is sent as JSON over HTTPS and is signed with the key of the ACME account, so the CA always knows which account sends a request:

1AccountTLSPilot registers an ACME account at the provider. Some providers require External Account Binding (EAB), for example ZeroSSL.

2OrderTLSPilot orders a certificate for the names you entered: the Common Name and the SANs.

3ChallengeTLSPilot proves control of every name with DNS-01, HTTP-01 or TLS-ALPN-01. The CA checks it from several network locations.

4FinalizeTLSPilot sends a CSR with a new key. The CA issues the certificate, and TLSPilot downloads it with its chain.

5RenewalA renewal is simply a new order. With ARI, the CA tells TLSPilot when to renew.

The three challenge types differ in what the CA checks. Chapters DNS-01, HTTP-01 and TLS-ALPN-01 explain each of them:

ACME challenge types at a glance
Challenge	How the CA checks	Good to know
DNS-01	A TXT record `_acme-challenge.<domain>` in the public DNS zone.	Works for wildcard names and for internal servers with a public DNS name. Requires API access to your DNS provider, or the manual DNS validation.
HTTP-01	A file under `/.well-known/acme-challenge/` on port 80.	Simple, no DNS access required. Port 80 must be reachable from the internet. No wildcard names.
TLS-ALPN-01	A special TLS handshake on port 443.	Only port 443 is used. No wildcard names. Rarely practical on Windows and IIS.

Why the validity of public certificates keeps getting shorter and what this means for you is explained in chapter Why automation matters.

In TLSPilot, the ACME account belongs to the ACME provider: the optional contact email for providers without EAB, the directory URLs, the EAB credential if the provider requires it and the default key algorithm, see Figure ACME account of a provider in TLSPilot and chapter ACME settings.