Automated Certificate Management Environment (ACME) is a protocol for automating certificate life cycle management communications between Certificate Authorities (CAs) and a company's web servers, email systems, user devices and any other PKI are used. In simple words, ACME is a protocol that makes it possible to automate the issuance and renewal of certificates, all without human interaction.



The Internet Security Research Group (ISRG) initially designed the ACME protocol for its own certificate service. 


How it works?


An organization can streamline and automate processes, such as CSR generation, domain ownership verification, certificate issuance and installation. 


ACME is used to obtain Domain Validated (DV) certificates. DV certificates do not require advanced verification. The only validation the CA is required to perform is to verify that the requester has an effective control of the domain. 


To use this protocol, an ACME client and ACME server is needed which communicates with JSON messages over a secure HTTPS connection. 


  • The client runs on any server or device that requires a trusted SSL/TLS certificate. It is used to request certificate management actions, such as certificate issuance.
  • The server runs at a Certificate Authority (CA) and responds to the requests of authorized clients. 


Clients using Linux must support cookies transfer in requests - Clients that use Linux servers should support ACME Session cookies.  Every time a Nonce request is made by the client to the ACME server, he needs to save the same cookie (ACME Session cookies) every time a request is made. 


DNS Authorization - A client can perform DNS authorization manually. The client should set a token in the TXT Record in the DNS Entry. This token will be sent to the ACME server, then the server will send a query to verify the token in TXT Record. 


Auto Renewal - In case of auto renewal of a server certificate in ACME, it is necessary that the certificate in the 'https binding' must be verified by a trusted certificate authority (CA). 


Automatic Certificate Management Environment (ACME) 


Field

Description

Enable Automatic Certificate Management Environment (ACME) 

Tick this checkbox to enable the ACME protocol 

External Account Binding Type 

External account bindings are used to associate an ACME account with an external account such as a CA custom database. 

Choose an external account binding type from the drop down:- 

None: If external binding type is NONE, then ACME server i.e. ADSS Web RA will not manage the user

Fixed: Existing ADSS Web RA account a user will be used, HMAC will be generated in system and that HMAC key will be consumed in each request for authentication purposes

Random: Existing ADSS Web RA account of user will be used, a random key will be generated for each ADSS Web RA request and that key will be used for authentication purpose of request

ACME URL

This is the ACME URL that the devices will use to communicate with ADSS Web RA for certificate generation