Let's Encrypt and ACME Protocol Automation

Let's Encrypt is a free, automated, and open Certificate Authority operated by the Internet Security Research Group (ISRG), launched in public beta in December 2015. It has issued over 3 billion certificates and dramatically increased HTTPS adoption across the web by eliminating the cost and complexity of obtaining publicly-trusted TLS certificates.

The Automated Certificate Management Environment (ACME) protocol, standardized as RFC 8555 in 2019, defines how clients automatically prove domain ownership and receive certificates from CAs. ACME replaces manual domain validation processes with a cryptographically-verified automated exchange, enabling zero-touch certificate lifecycle management.

The HTTP-01 challenge validates domain ownership by requiring the ACME client to place a specific token file at "http://DOMAIN/.well-known/acme-challenge/TOKEN". The CA fetches this URL to verify the token. HTTP-01 is simple to implement but requires port 80 to be accessible and cannot be used for wildcard certificates.

The DNS-01 challenge validates domain ownership by requiring the ACME client to create a DNS TXT record at "_acme-challenge.DOMAIN" with a specific value. The CA queries DNS to verify the record. DNS-01 is the only challenge type that supports wildcard certificate issuance ("*.example.com") and works even when web servers are behind firewalls.

The TLS-ALPN-01 challenge validates domain ownership at the TLS layer using a custom ALPN protocol identifier "acme-tls/1". The ACME client temporarily serves a self-signed certificate with the challenge token in a special extension on port 443. This challenge works without a running web server and supports load-balanced environments.

Certbot is the Electronic Frontier Foundation's reference ACME client for Let's Encrypt. It automates the full certificate lifecycle: domain validation, certificate issuance, and automatic renewal. Certbot includes plugins for Apache and nginx that automatically configure TLS settings. Install via "snap install --classic certbot" on modern Linux distributions.

Many ACME clients beyond Certbot exist for different use cases. acme.sh is a pure shell script ACME client widely used in lightweight environments. Caddy web server has built-in ACME and auto-renews certificates automatically. Traefik, used in container environments, handles ACME via its certificatesResolvers configuration for containerized workloads.

Let's Encrypt certificates have a 90-day validity period by design, encouraging automation and reducing the window of exposure for compromised private keys. Certbot installs a systemd timer or cron job that runs "certbot renew" twice daily, renewing any certificate within 30 days of expiry. Manual renewal is an anti-pattern that leads to outages.

Let's Encrypt enforces rate limits to prevent abuse. The main limits are 50 certificates per registered domain per week and 5 duplicate certificates per week. Failed validation attempts (5 per hostname per hour) are also rate-limited. During development, the Let's Encrypt staging environment provides unlimited certificate issuance against a test CA that is not publicly trusted.

A single ACME certificate can cover multiple domains (Subject Alternative Names). "certbot --domains example.com,www.example.com,api.example.com" issues a certificate with three SANs. Wildcard certificates ("*.example.com") require DNS-01 validation and cover all single-level subdomains. Wildcards do not cover the apex domain (example.com) itself, requiring an additional SAN.

The ACME protocol is not limited to Let's Encrypt. Internal CAs like Step-CA (smallstep), EJBCA, and HashiCorp Vault can expose ACME endpoints for internal certificate automation. This enables the same automated certificate lifecycle management used for public-facing services to be applied to internal mTLS infrastructure and private services.

Which ACME challenge type is required to issue a wildcard certificate such as "*.example.com"?

Let's Encrypt provides free certificates via the ACME protocol (RFC 8555). HTTP-01 challenges work for non-wildcard certs on port 80. DNS-01 enables wildcard certificates by proving DNS zone control. TLS-ALPN-01 works without a web server. Certbot and acme.sh automate the full lifecycle. 90-day certs require automation. Rate limits necessitate using the staging environment during testing.