What is ACME and How Does it Work?

ACME History

ACME was created by the non-profit corporation Internet Security Research Group (ISRG) for Let’s Encrypt and is backed by the Electronic Frontier Foundation. ACME made it possible to automatically renew and replace certificates without any action needed from the website owners. In March 2019, the ACME protocol was published as an internet standard and has since gained support among PKI vendors, CAs, and browsers supporting various X.509 certificates.

Benefits of ACME SSL

Various benefits are brought by automation through ACME SSL. With its main objective to make certificate lifecycle management more efficient, ACME:

1. Saves time and resources for your organization by eliminating manual tasks such as filling out CSRs and manually completing domain validations.
2. Eliminates human errors in management of SSL/TLS certificates, avoiding outages.
3. Allows quick issue mitigation through replacement of old certificates in the case of compromise.
4. Enhances security through its open-source feature.

Google's 90 Day Certificate Validity Plans Require CLM Automation

Extracted from our recent blog:

Following the CA/B Forum face-to-face meetings held in early March 2023, Google announced its intention to reduce maximum certificate validity to just 90 days for all publicly-trusted SSL/TLS certificates.

While there is not yet an effective date or deadline for this change – now is the time to begin planning automation of your certificate lifecycle management for SSL/TLS.

To eliminate the burden of having to manage certificates manually, ACME can be utilized to fully automate certificate management and streamline your organization’s SSL/TLS issuance, installation, revocation, and replacement.

GlobalSign ACME

ACME is generally free. However, using these free services requires ACME users to go through crowd-sourced support in forums, which operate without SLAs. This makes it challenging to find the best solution for your organization.

GlobalSign’s ACME service changes this. Aside from receiving full support and SLAs from a trusted Certificate Authority (CA), this ACME service is powered by Atlas, GlobalSign’s next-generation Cloud CA that features high throughput and availability. Customers also have the flexibility to use any ACME client based on the organization’s needs. With over 25 years of industry experience, GlobalSign ensures that your business is protected by a trusted CA – your partner in finding the right solutions.

GlobalSign’s ACME service can issue both domain and organisation validated (OV) SSL/TLS certificates

GlobalSign is constantly looking to improve the certificate management. Recently, GlobalSign announces ACME OV certificate support. GlobalSign’s ACME OV certificates are issued from its high-volume cloud-based certificate management platform to avoid any delay within the certificate lifecycle. GlobalSign’s ACME OV certificates are ideal for a wide range of organizations seeking a high level of support – and affordable pricing – from one of the world’s most trusted and relied upon Certificate Authorities.

ACME SSL in APAC

There are over a hundred Certificate Authorities in the market valued at USD 127 million in 2021. Asia Pacific is one of the fastest growing markets for CAs, attributed to the increasing instances of cyberattacks, tightening regulations, and the IoT trend in the region. Despite the potential growth, not all certificate authorities offer ACME, and awareness for cybersecurity products like automated certificate lifecycle management remains a challenge due to the complications in its open-source structure. GlobalSign eliminates this issue. Being one of the few providers of ACME in the APAC market, GlobalSign continues to raise awareness about the benefits of ACME. Moreover, GlobalSign’s ACME boasts 24/7 support and operates through SLAs, ensuring that the needs of the organization are being met.

ACME protocol

Certificate management automation is made possible through the ACME protocol. The ACME protocol’s main purpose is to provide a way to validate that someone who requests a certificate management action is authorized. The verification process uses key pairs. The agent generates and shares a key pair with the Certificate Authority. When validated, the agent uses the key to digitally sign the CSR that is sent to the CA through HTTPS. This CSR, along with the public key, is used to issue the certificate and sent back to the agent.

It is important to note that the agents can be automated, and the process does not require any human intervention, minimizing errors in filling out CSRs.

How does GlobalSign’s ACME protocol work?

One of the best features of GlobalSign’s ACME is the flexibility it provides. The ACME client is chosen based on organization’s needs, while the agents are stored on the web servers. The agents are configured to contact Atlas and an account key pair is created. After which, the following will occur:

1. The agent sends a request and digitally signs it with its account key pair.
2. Atlas, GlobalSign’s cloud CA, sends a domain validation challenge to verify the agent is authorized to act on behalf of the server. The agent sends a response and signs it with the account key pair. Verification is done by Atlas.
3. After successful verification, the agent generates a CSR and sends it to Atlas with a digital signature and the account key pair.
4. Atlas verifies the digital signature and GlobalSign issues the SSL/TLS certificates.
5. The agent receives the certificate and is installed to the web server.

How do I revoke SSL certs with ACME?

Certificate revocation works through sending a revocation request and signing it with the account key or private key of the TLS certificate for revocation. Atlas then verifies the digital signature, and the certificate is revoked by GlobalSign.

ACME client implementations

Since ACME is open-source, ACME clients are offered by third parties. Multiple options are available for ACME client implementations. Listed below are the most common:

1. Certbot – the Certbot client can help you issue or renew and install certificates. Certbot offers great documentation and works on multiple systems.
2. Posh-ACME – Posh-ACME is a PowerShell module and ACME client designed to obtain SSL/TLS certificates from an ACME capable CA. However, it does not deploy certificates to the web server.
3. GetSSL – GetSSL runs on virtually all Unix machines. This ACME client runs as a daily cron, automatically renewing certificates when required. Automatic updates are also supported to fix the script when bug fixes are required.

Other ACME client options include ACMESharp, Caddy, Sewer, and more. ACME Clients can be chosen depending on the need of your business.

ACME Windows server

The ACME protocol may be more widely used in Linux servers yet automating certificates in Windows ecosystems is also possible. The process begins with choosing the right client. However, in most cases, the client cannot complete the installation process due to the inability to deploy the new certificate in Windows.

Common ACME clients’ options for Windows servers include Crypt::LE (previously ZeroSSL project), Certes, Posh-ACME, Certify The Web (Windows), and WinCertes Windows client.

ACME Nginx server

ACME can also automate certificate management in Nginx systems. In using ACME Nginx server, lua-resty-auto-ssl, Nginx ACME, and lua-resty-acme are commonly used.

Setting up in Nginx servers requires configuration by setting a location directive in Nginx’s config. After this, we can generate the certificates for both the root domain and the subdomain, using the site directory. To fully implement the ACME protocol, the certificate generated must be known to Nginx.

ACME Apache server

Version 2.4.30 and later versions of Apache supports ACME integration with various Certificate Authorities using the mod_md module for automated certificate management within the Apache ecosystem. This module generates and renews certificates via ACME protocol, avoiding downtimes caused by expirations. It also adds support for CAs through External Account Binding (EAB) when EAB values are required for ACME account registration with their respective ACME servers.