What is ACME Protocol and How does it Work: A Complete Guide

You might have visited a website and seen a warning that says: “Your connection is not private.” This often happens when a website’s security certificate has expired. It is a small oversight that can harm a website’s reputation and make visitors think twice before proceeding. For website owners, managing digital certificates manually can be a real challenge. To simplify this process, the ACME Protocol was developed. It stands for Automatic Certificate Management Environment, which automates the issuance and renewal of SSL/TLS certificates, making certificate lifecycle management more efficient.

In this guide, we will take a look at the ACME Protocol, how it works, how to set it up, and why it has become the most popular method for automating certificate management.

What is ACME Protocol?

Automated Certificate Management Environment or ACME Protocol is an open standard for automating processes of obtaining, validating, issuing, renewing, and revoking SSL/TLS certificates. These certificates are essential for secure HTTPS communication, encrypting data transfers between users and servers to maintain confidentiality and integrity. Beyond websites, digital certificates also secure communications between Certificate Authorities (CAs) and an organization’s web servers, email systems, user devices, and other systems that rely on Public Key Infrastructure (PKI) certificates.

The Internet Security Research Group (ISRG) created ACME to make the deployment of HTTPS easier. The process is now standardized as RFC 8555 to be compatible with multiple systems and applications.

Before ACME was introduced, certificates were obtained through a manual, expensive, and error-prone process. Website owners had to generate a Certificate Signing Request (CSR), prove domain ownership with arbitrary methods, and manually renew certificates. ACME automated the whole process and eliminated human intervention.

The ACME protocol operates on a client-server model:

1. ACME Client

   Tools like Certbot, acme.sh, and Lego run on the user’s server. These client tools communicate with the ACME server and confirm tasks such as generating Certificate Signing Requests (CSRs) and managing the issuance and renewal of X.509 certificates.

2. ACME Server

   The ACME server is typically managed by Certificate Authorities that support the ACME protocol. Its main role is to verify domain ownership by using different types of challenges, such as HTTP-01, DNS-01, or TLS-ALPN-01. Once the domain is verified, the CA issues the necessary certificates and manages the renewal and revocation of those certificates as needed.

ACME makes HTTPS deployment more accessible and affordable by automating manual tasks such as domain ownership validation, certificate issuance, renewal, and revocation, resulting in securing millions of websites around the world.

How Does ACME Protocol Work?

The ACME protocol establishes communication between an ACME client and an ACME server. Here’s the breakdown on how the process typically unfolds:

1. Account Creation

   The ACME client begins by registering an account with the CA. It involves generating a private key and sharing its associated public key with the CA to establish identity. The CA associates this key with the account, which is later used to authenticate future certificate-related requests.

2. Domain Ownership Validation

   To prove control over a domain, the CA issues an ACME challenge, which serves as an authentication step. The CA will not issue the certificate until this challenge is successfully passed. Currently, there are three types of ACME challenges:

   Challenge 1 – HTTP-01

   In this challenge, the CA requests that a specific file be hosted at a predefined URL on the domain via HTTP (port 80). The ACME client must serve the file with the correct token and thumbprint of the authorization key in the file’s contents. Once the CA retrieves the file and validates it, domain ownership is confirmed.

   Challenge 2 – DNS-01

   For this challenge, the ACME client should add a unique TXT record to the domain’s DNS configuration. This record contains a token sent by the CA, and the ACME client appends a thumbprint of the authorization key. The CA queries the DNS and verifies the record to confirm the client’s control over the domain.

   Challenge 3 – TLS-ALPN-01

   In this challenge, the ACME client sets up a temporary TLS certificate over port 443 via ALPN (Application Layer Protocol Negotiation) extension. The CA then tries to connect to the server of the domain, validate the certificate, and verify the ownership.

3. Certificate Issuance

   Once the domain has been validated, the ACME client sends the requesting CA a certificate signing request (CSR). Then CA generates an SSL/TLS certificate and provides it to the client for download.

4. Certificate Installation and Renewal

   The ACME client installs the certificate automatically on the server and periodically renews it before expiration, so there is uninterrupted HTTPS functionality.

5. Certificate Revocation (Optional)

   If a certificate is compromised or no longer required, the ACME client can request its revocation from the CA in a secure manner.

How to set up ACME client configurations

To set up an ACME client, you need to download the client software, configure it to communicate with an ACME server, and automate certificate issuance, renewal, and management.

Step 1: Select an ACME Client

ACME clients are tools that interact with an ACME server to request and manage certificates. Popular ACME clients include:

1. Certbot: The most widely used ACME client, maintained by the EFF. It is compatible with multiple operating systems and web servers.
2. acme.sh: A lightweight shell script client that supports various CAs.
3. lego: A Go-based client with excellent cross-platform support.
4. Caddy: A web server with built-in ACME support for automatic HTTPS.
5. Other Clients: Tools like Posh-ACME (for PowerShell users) or Certify The Web (GUI-based ACME client for Windows).

You can select a client based on your operating system, server setup, and requirements.

Step 2: Install the ACME Client

Installation depends on the client but most packages can be installed through package managers. For example, Certbot can be installed on a Linux server using

sudo apt-get install certbot

Whereas if you want to install acme.sh then use the below command

curl https://get.acme.sh | sh

Step 3: Configure the ACME Client

Every ACME client must register an account with the ACME server (CA) to begin the certificate issuance process. You need to configure the client by specifying the domain for which you want to obtain a certificate. Certbot can be configured using the command

sudo certbot register --email your-email@example.com --agree-tos

And to configure acme.sh use

acme.sh --register-account --email your-email@example.com

Make sure to change example.com to your own domain address.

Step 4: Obtain a certificate

Next, choose the validation method (HTTP-01, DNS-01, or TLS-ALPN-01) and specify the domain name(s) for which you want to issue a certificate.

1. For HTTP-01

   • Certbot command (Using Nginx or Apache)

     sudo certbot --nginx -d example.com -d www.example.com

   • acme.sh command

     acme.sh --issue -d example.com -d www.example.com --webroot /var/www/html

2. For DNS-01

   • Certbot command

     sudo certbot -d '*.example.com' --manual --preferred-challenges dns

   • acme.sh command

     acme.sh --issue -d example.com --dns dns_yourprovider

3. For TLS-ALPN-01

   • Certbot does not have built-in support for the TLS-ALPN-01 challenge as it is more focused on the HTTP-01 and DNS-01 challenges.
   • acme.sh command

     acme.sh --issue -d example.com --alpn

Step 5: Install the Certificate

Once issued, install and configure the certificate for your web server or application.

1. If you are using an Apache server

   First, copy the issued certificate and private key to the appropriate directory:

   sudo cp /etc/letsencrypt/live/example.com/fullchain.pem /path/to/apache/certs/
   sudo cp /etc/letsencrypt/live/example.com/privkey.pem /path/to/apache/private/

   Then, update the Apache configuration accordingly

   <VirtualHost *:443>
   ServerName example.com
   SSLEngine on
   SSLCertificateFile /path/to/apache/certs/fullchain.pem
   SSLCertificateKeyFile /path/to/apache/private/privkey.pem
   </VirtualHost>
   

   Finally, restart your Apache server

   sudo systemctl restart apache2

2. If you are using the Nginx server

   Copy the issued certificate and private key to the correct location:

   sudo cp /etc/letsencrypt/live/example.com/fullchain.pem /path/to/nginx/certs/
   sudo cp /etc/letsencrypt/live/example.com/privkey.pem /path/to/nginx/private/

   Update the Nginx configuration accordingly

   server {
       listen 443 ssl;
       server_name example.com;
   
       ssl_certificate /path/to/nginx/certs/fullchain.pem;
       ssl_certificate_key /path/to/nginx/private/privkey.pem;
   }
   

   Followed by this restart your nginx server

   sudo systemctl restart nginx

Step 6: Automate Certificate Renewal Process

1. Certbot

   Certbot sets up a cron job or systemd timer during installation. Verify its status:

   sudo systemctl status certbot.timer

2. acme.sh

   acme.sh does not set up a cron job automatically. So to set up a cron job use

   crontab -e

   0 0 * * * "/path/to/acme.sh" --cron --home "/path/to/acme.sh/"

What are the Benefits & Use Cases of ACME Protocol?

The ACME Protocol has transformed the way organizations handle digital certificate management by introducing automation and scalability to what was once a manual and error-prone process. ACME Protocol offers several benefits, particularly for those who wants to improve security and operational efficiency.

1. Automation

   Automation is the most important advantage of ACME. The certificate issuance, installation, and renewal are handled without any manual intervention, reducing the possibility of human error and keeping a check that certificates remain updated.

2. Cost-Effective

   ACME is a great solution for businesses wanting to secure their website without having to pay out a large sum of money. It accommodates all of this with additional features and higher levels of assurance as per the specific requirements or preferences.

3. Improved Security

   Using ACME for certificate renewals automates the process of renewal which minimizes the risk that expired certificates can leave a site vulnerable to attacks.

4. Scalability

   In environments where numerous certificates are required, like large websites, and enterprise systems, ACME is the best. It simplifies certificate management across multiple domains.

5. Time-Saving

   The full certificate life cycle from request to renewal is automated which saves time and resources.

Setting Up and Initializing the ACME Protocol

Setting up the ACME protocol is easy, as you need to configure an ACME client and then serve it on your server to maintain Public Key Infrastructure (PKI) certificates. Here’s how it works:

1. The ACME client asks for the domains you want to manage.
2. It lists the Certificate Authorities (CAs) that support ACME.
3. Once you choose a CA, the client creates a pair of cryptographic keys.
4. The CA will make you complete a verification challenge, either through DNS or HTTPS.
5. The CA sends a random number (nonce), which the client signs with its private key for authentication and to prove ownership.

Why Choose ACME for Certificate Lifecycle Management?

The ACME protocol revolutionized the way we manage SSL/TLS certificates by automating complex tasks including issuance, renewal, and revocation of certificates. With the ACME clients, manual processes become easier and automated, as there is less chance for error, and is a time-saving option. Tools like Certbot handle renewals and validations without you ever encountering expired certificates and your site always remains secure.

ACME is both user-friendly and versatile, supporting different certificate types, such as SSL/TLS certificates, wildcard certificates, or multi-domain certificates to meet a number of requirements. ACME is appropriate for any business from a single website user to large-scale infrastructure. Along with this, it is an economical alternative for private and business websites that wish to increase web security, but without a huge expense.

Another key advantage of ACME is its robust flexibility and wide compatibility with diverse operating systems, programming environments, and certificate authorities. ACME simplifies domain validation through DNS or HTTP challenges and only uses strong cryptography throughout the certificate lifecycle. If you are looking for a comprehensive solution to manage your certificate lifecycle, for that you can explore certificate lifecycle management.

What Types of TLS/SSL Certificates and PKI Certificates Does ACME Support?

The ACME Protocol is designed to support several types of certificates, which makes it a great choice for securing all kinds of online communications. ACME supports SSL/TLS certificates, which are important for enabling secure, encrypted connections between web servers and browsers. ACME also supports different types of validations, like Domain Validation (DV), Organization Validation (OV), and Extended Validation (EV). While DV certificates are much simpler and straightforward, OV and EV certificates need a bit more verification steps that may go beyond what ACME directly handles.

In addition to standard SSL certificates, ACME simplifies the management of wildcard certificates which cover the whole domain and all of its subdomains in one single certificate. Wildcard certificates are issued through DNS-based validation (DNS-01 challenge). Additionally, it also handles SAN (Subject Alternative Name) certificates that enable the protection of multiple domains while requiring you to manage just one certificate. Moreover, if you’re into software development, ACME also supports code signing certificates, which verifies the authenticity and integrity of your software.

Conclusion

The ACME Protocol has made managing digital certificates a lot simpler. It handles everything from validating your domain to issuing, renewing, and installing certificates automatically. It works well for businesses because it’s easy to set up and doesn’t cost a fortune. Whether you’re handling one website or a whole infrastructure, ACME streamlines everything by cutting down on errors and boosting security.