Certificates used to expire because someone forgot a calendar entry. ACME — the protocol behind Let’s Encrypt and now most public and private CAs — removed the human from the loop. This guide covers how the protocol actually works and the failure modes automation introduces.
The protocol in one pass
An ACME client creates an account, submits an order for a set of names, proves control of each name via a challenge (HTTP-01, DNS-01 or TLS-ALPN-01), and then submits a CSR. The CA validates, issues, and the client fetches the certificate — all JSON over HTTPS, all scriptable.
Choosing a challenge type
HTTP-01 is simplest but needs port 80 reachable. DNS-01 works for wildcards and internal hosts but hands your DNS API credentials to the renewal machinery — scope them tightly. TLS-ALPN-01 suits terminating proxies that cannot serve arbitrary HTTP paths.
Where automation bites
Renewal is the easy 95%. The hard 5%: rate limits during incident-driven mass reissuance, DNS propagation races, and services that load certificates once at startup and never again. Monitor expiry of what is actually served, not what sits on disk.
Running ACME internally
Private CAs like step-ca and EJBCA speak ACME too. Short-lived certificates plus ACME renewal is the strongest revocation story there is: a certificate that expires in 24 hours barely needs revoking.