Skip to main content

RFC 8555 - Automatic Certificate Management Environment (ACME)

Internet Engineering Task Force (IETF) Request for Comments: 8555 Category: Standards Track ISSN: 2070-1721

Authors: R. Barnes (Cisco) J. Hoffman-Andrews (EFF) D. McCarney (Let's Encrypt) J. Kasten (University of Michigan)

Published: March 2019

Abstract​

Public Key Infrastructure using X.509 (PKIX) certificates are used for a number of purposes, the most significant of which is the authentication of domain names. Thus, Certification Authorities (CAs) in the Web PKI are trusted to verify that an applicant for a certificate legitimately represents the domain name(s) in the certificate. As of this writing, this verification is done through a collection of ad hoc mechanisms. This document describes a protocol that a CA and an applicant can use to automate the process of verification and certificate issuance. The protocol also provides facilities for other certificate management functions, such as certificate revocation.

Status of This Memo​

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG).

Key Features​

ACME Protocol Benefits:

  • ⚡ Fully Automated: Zero manual intervention from request to renewal
  • 🔄 Frequent Updates: Supports short-lived certificates (Let's Encrypt default: 90 days)
  • 💰 Cost Reduction: Eliminates manual process costs
  • 🔒 Enhanced Security: Short-lived certificates reduce exposure risk

Typical ACME Workflow:

Client (ACME Client)                    ACME Server (CA)
       |                                        |
       |  1. Create Account                     |
       |--------------------------------------->|
       |     <-- Account URL                    |
       |                                        |
       |  2. Submit Certificate Order           |
       |--------------------------------------->|
       |     <-- Order Object + Auth Challenges |
       |                                        |
       |  3. Complete Domain Validation         |
       |     (HTTP-01 or DNS-01)               |
       |--------------------------------------->|
       |     <-- Validation Success             |
       |                                        |
       |  4. Finalize Order (Submit CSR)        |
       |--------------------------------------->|
       |     <-- Certificate URL                |
       |                                        |
       |  5. Download Certificate               |
       |--------------------------------------->|
       |     <-- PEM Format Certificate Chain   |

Core Components​

Resource Types​

  1. Directory: Server API endpoint directory
  2. Account: Client account information
  3. Order: Certificate order
  4. Authorization: Domain authorization
  5. Challenge: Validation challenge
  6. Certificate: Issued certificate

Validation Methods​

  • HTTP-01 Challenge: Provision file at specific HTTP path
  • DNS-01 Challenge: Provision specific DNS TXT record
  • Certbot (EFF Official)
  • acme.sh (Shell Script)
  • Lego (Go Language)
  • win-acme (Windows)
  • RFC 7515 - JSON Web Signature
  • RFC 5280 - X.509 Certificates
  • RFC 6797 - HSTS
  • RFC 7807 - Problem Details for HTTP APIs

References​

For detailed technical specifications, please refer to the official RFC 8555 document.