RFC 8555 / START HERE
ACME, before the details
ACME: Automatic Certificate Management Environment
ACME automates obtaining and managing certificates. A server proves control of identifiers such as domain names before a certificate authority issues a certificate.
The idea in one picture
A server requests a certificate
Control of the domain is checked
A certificate can be issued
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Manual certificate setup and renewal are easy to get wrong. Automation makes routine certificate maintenance more practical.
A familiar example
A website server completes a domain-control challenge and obtains a certificate it can use for HTTPS.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- An order is a state machineAn order becomes ready only after its required authorizations are satisfied.→
- One nonce for one signed requestA server-provided nonce prevents reuse of the same signed ACME request.→
- HTTP proves control of a pathThe client publishes a key authorization at a server-chosen challenge path.→
- DNS proves control of a recordA TXT record carries a digest of the challenge’s key authorization.→
- CSR, certificate, and revocationIdentifier authorization and possession of the certificate key are different checks.→
This introduction explains RFC 8555 (2019). Read the original RFC ↗