ACME protocol
ACME (Automated Certificate Management Environment), defined in RFC 8555, is a protocol that lets a server prove it controls a domain and receive a signed TLS certificate automatically, with no human filling out a request form or exchanging files with a certificate authority by hand. A client proves domain control by completing a challenge the CA specifies, commonly either serving a specific file at a well-known HTTP path or publishing a specific DNS TXT record; once that challenge is validated, the CA issues the certificate and the client installs it, all over a scripted HTTPS API. ACME is what makes short-lived certificates practical: Let's Encrypt, the CA that popularized it, issues certificates valid for only 90 days, which would be unworkable to renew manually at any scale but is routine when a cron job or server plugin re-runs the same ACME exchange automatically before each one expires.
By AdminKit team, Netbase JSC · Updated