How ACME works
ACME, the Automatic Certificate Management Environment defined in RFC 8555, turns the conversation between a certificate requester and a certificate authority into an API. The client first creates an account with the CA, identified by an account key pair. To obtain a certificate it places an order for one or more domain names, and the CA responds with challenges: prove you control these names. With HTTP-01, the client serves a specific token at a well-known URL on the domain; with DNS-01, it publishes a specific TXT record; TLS-ALPN-01 exists as a third option for TLS-terminating infrastructure.
Once the CA verifies a challenge, the client finalizes the order by submitting a certificate signing request, and the CA issues the certificate, typically short-lived. The same machinery then repeats on a schedule: the client renews well before expiry without any human involvement, which is precisely the point. The protocol was popularized by Let’s Encrypt, but it is an open standard, and any ACMEv2-compatible CA or endpoint can sit on the other side, including internal enterprise endpoints.
Why it matters
Before ACME, renewing a certificate meant a human noticing an expiry date, filling out a CSR, waiting for validation emails and copying files onto servers, a process that failed often enough to make expired certificates a routine cause of outages. ACME removes that toil entirely: validation, issuance, renewal and even deployment hooks run as code, so a certificate becomes something the infrastructure maintains for itself.
Automation is also what makes short certificate lifetimes viable at all. As public TLS lifetimes shrink, renewing manually every few weeks is not realistic for any fleet of meaningful size, and ACME is becoming the default issuance path rather than an alternative one. The same logic is reaching compliance: frameworks that expect certificates to be inventoried and rotated on time implicitly expect an automated pipeline underneath, and ACME is the standard way to build it.
How enterprises use ACME
For public-facing certificates, enterprises point ACME clients at Let’s Encrypt or at commercial CAs that expose ACME endpoints, keeping paid validation levels and support while gaining automated renewal. For internal certificates, the same protocol works against ACME-compatible private CAs, so services inside the network get the same hands-off lifecycle as public websites, from one consistent mechanism.
In practice, most organizations do not run a bare ACME client per server; they let a certificate lifecycle management platform coordinate. The platform tracks the inventory, decides when to renew, completes challenges and deploys the result, speaking ACME toward whichever endpoint each certificate needs, Monopam’s certificate manager among them, toward any compatible endpoint. That keeps the protocol an implementation detail while teams work with policies and dashboards.