ACME in depth · 18.3
ACME profiles
Some CAs offer several kinds of certificates under one ACME directory, for example with different validity. These variants are called profiles. The CA lists them in its directory (meta.profiles), and the client selects one by name when it orders a certificate. ACME profiles are an IETF draft that is not yet an RFC.
- Selection per certificate: If the directory of the provider offers profiles, the tab Settings of an ACME certificate shows the field Profile. The default CA default sends no profile, so the CA uses its default. The list also shows the profiles the CA currently offers, with their description. Without profiles in the directory, the field is hidden. Profiles that a CA adds later appear without an update.
- Profile not offered: If the CA does not offer a stored profile, TLSPilot logs a warning, falls back to the default of the CA and shows a hint in Next action. If the CA rejects a profile (
invalidProfile), TLSPilot shows a clear message and does not retry in a loop. - Short-lived profiles: Profiles such as
shortlivedrenew at their own planned time. Renewal follows the profile’s own timing, not the deployment & health cycle. - PowerShell:
New-TLSPilotCertificate -Profileselects the profile in scripts.
| CA | Profile | Validity | Notes |
|---|---|---|---|
| Let’s Encrypt | classic | 90 days; 64 days from 10.02.2027; 45 days from 16.02.2028 | Default profile, up to 100 names |
| Let’s Encrypt | tlsserver | 45 days | Up to 25 names, without Common Name |
| Let’s Encrypt | shortlived | 160 hours (about 6 days) | Up to 25 names. Let’s Encrypt issues IP address certificates only with this profile, but TLSPilot does not accept IP addresses for ACME; use the Enterprise CA or the Private CA. |
| Google Trust Services | minimal, standard | Defined by the CA | GTS requires EAB |
| ZeroSSL, Sectigo, DigiCert ONE | – | – | No profiles offered (as of 09.10.2026); the field Profile is hidden |
TLSPilot reads the profiles from the directory of the CA and offers them in the field Profile of an ACME certificate, see Figure Profiles offered by the ACME provider in the field Profile.
