ACME SSL Automation: The Complete Guide to Automated SSL Certificate Management
Why SSL certificate automation is no longer optional
For many years, managing SSL/TLS certificates was a relatively simple task. An administrator purchased a certificate, completed the validation process, installed it on the server and repeated the process once a year.
That approach is rapidly becoming obsolete.
The CA/Browser Forum, together with the major browser vendors and Certification Authorities, has approved a progressive reduction in the maximum lifetime of publicly trusted SSL/TLS certificates. The goal is to improve the overall security of the Internet by requiring more frequent validation of certificate data and encouraging modern automated management practices.
The consequence is simple:
Manual certificate management is no longer sustainable.
As certificate lifetimes continue to shrink, every organisation—from small businesses running a single website to enterprises managing thousands of certificates—will need to automate the certificate lifecycle.
The industry-standard solution for achieving this is ACME (Automatic Certificate Management Environment).
The evolution of SSL certificate validity
Certificate validity has steadily decreased over the last decade.
| Date | Maximum certificate validity |
|---|---|
| Before 2015 | Up to 5 years |
| March 2018 | 825 days |
| September 2020 | 398 days |
| March 15, 2026 | 200 days |
| March 15, 2027 | 100 days |
| March 15, 2029 | 47 days |
These changes affect virtually all publicly trusted SSL/TLS certificates, regardless of whether they are Domain Validated (DV), Organization Validated (OV), or Extended Validation (EV).
Why certificate validity is getting shorter
The purpose of shorter certificate lifetimes is not to make life harder for system administrators.
Instead, it improves Internet security in several important ways:
- Domain ownership is verified more frequently.
- Organisational information is refreshed more often.
- Compromised certificates have a much shorter useful lifetime.
- Cryptographic best practices can evolve more rapidly.
- Certificate ecosystems become more agile and resilient.
Short-lived certificates reduce the amount of time incorrect or outdated information can remain trusted by browsers.
The hidden problem with manual renewals
When certificates lasted one year—or even two years—it was still realistic to manage them manually.
Today, the numbers tell a different story.
| Certificate lifetime | Renewals per year |
| 398 days | About 1 |
| 200 days | About 2 |
| 100 days | About 4 |
| 47 days | More than 8 |
Imagine managing:
- 10 certificates
- 100 certificates
- 1,000 certificates
Every renewal typically requires:
- requesting a new certificate
- completing domain validation
- downloading certificate files
- installing the certificate
- restarting or reloading services
- verifying successful deployment
Multiply that process eight times per year.
The administrative workload quickly becomes enormous.
Even worse, every manual step introduces the possibility of human error.
An expired certificate can cause:
- Website downtime
- API failures
- Email disruption
- VPN outages
- Loss of customer trust
- Revenue loss
Automation is no longer simply convenient—it has become essential.
What is ACME?
ACME (Automatic Certificate Management Environment) is an open protocol defined by RFC 8555 that allows software to communicate directly with a Certification Authority.
Instead of requiring an administrator to manually request and install certificates, the server performs the entire process automatically.
An ACME client can:
- request new certificates
- prove domain ownership
- download issued certificates
- install certificates
- renew certificates before expiration
- replace revoked certificates
Once configured, the entire certificate lifecycle operates automatically.
How ACME works
A typical ACME workflow consists of only a few steps.
1. The ACME client creates an account
The server registers with the Certification Authority.
Examples of ACME clients include:
- Certbot
- acme.sh
- win-acme
- Lego
- Posh-ACME
2. Certificate request
The client requests a certificate for one or more domain names.
Example:
example.com
www.example.comor
*.example.com3. Domain validation
The Certification Authority verifies control of the domain.
This usually happens through one of three challenge methods:
HTTP-01
The client places a temporary file on the website.
Ideal for:
- Apache
- NGINX
- IIS
DNS-01
The client automatically creates a TXT record inside DNS.
Required for:
- Wildcard certificates
- Internal services
TLS-ALPN-01
Validation occurs directly over TLS.
Typically used for specialised environments.
4. Certificate issuance
Once validation succeeds, the CA issues the certificate.
5. Automatic installation
The ACME client installs:
- certificate
- private key
- certificate chain
Many clients also reload the web server automatically.
6. Automatic renewal
Long before expiration, the ACME client repeats the process.
No administrator intervention is required.
The entire lifecycle becomes completely automatic.
What do you need to use ACME?
The requirements are surprisingly simple.
An ACME-compatible certificate
Not every certificate product supports ACME.
Currently available products include:
| Product | Automation |
| RapidSSL Plan + Automate | ✔ |
| RapidSSL Wildcard Plan + Automate | ✔ |
| GeoTrust DV Plan + Automate | ✔ |
| GeoTrust DV Wildcard Plan + Automate | ✔ |
| More ACME-enabled products coming soon | Coming soon |
Our portfolio of ACME-compatible certificates will continue to expand over time.
An ACME client
Examples include:
A compatible server or platform
Most modern web servers already support ACME directly or through plugins.
Benefits of ACME automation
Using ACME provides significant operational advantages.
Eliminate certificate expiration
Certificates renew automatically before they expire.
Reduce administrative workload
No more calendar reminders.
No more manual installations.
No more renewal spreadsheets.
Improve security
Frequent certificate rotation reduces risk and aligns with industry best practices.
Minimize downtime
Automatic renewals dramatically reduce the chance of unexpected certificate expiration.
Future-proof your infrastructure
As certificate lifetimes continue to decrease, your infrastructure is already prepared.
ACME compatibility
The following platforms are commonly compatible with ACME-based certificate automation.
| Platform / Software | ACME Support |
| Apache HTTP Server | ✔ Native / Client-based |
| NGINX | ✔ Native / Client-based |
| Microsoft IIS | ✔ (win-acme and compatible clients) |
| Linux servers | ✔ |
| Windows Server | ✔ |
| cPanel | ✔ |
| Plesk | ✔ |
| DirectAdmin | ✔ |
| Kubernetes | ✔ |
| Docker containers | ✔ |
| HAProxy | ✔ |
| Traefik | ✔ Native |
| Caddy Server | ✔ Native |
| OpenLiteSpeed | ✔ |
| LiteSpeed Enterprise | ✔ |
| Synology NAS | Partial (depending on DSM version) |
| QNAP NAS | Partial |
| pfSense | ✔ Package available |
| OPNsense | ✔ Plugin available |
Compatibility depends on the chosen ACME client and server configuration. Most modern hosting environments support ACME either natively or through widely available clients and plugins.
Why now is the right time to automate
Many organisations are waiting until certificate validity reaches 47 days before considering automation.
That is a mistake.
Migrating to an automated workflow takes planning, testing, and validation.
Implementing ACME today allows you to:
- eliminate manual renewals immediately;
- prepare for future industry changes;
- reduce operational costs;
- improve service availability;
- protect your websites against unexpected certificate expiration.
Organisations that adopt automation early will be ready for future certificate lifecycle reductions with virtually no additional effort.
Conclusion
SSL certificate management is undergoing its biggest transformation in more than twenty years.
The era of annual manual renewals is ending.
As certificate validity continues to decrease—from 398 days to 200 days, then 100 days, and finally just 47 days—automation is becoming an operational necessity rather than a convenience.
ACME provides an open, standardised, and reliable method for automating every stage of the certificate lifecycle, from issuance and validation to installation and renewal.
Whether you manage a single website or thousands of servers, adopting ACME today will reduce administrative overhead, eliminate the risk of expired certificates, and ensure your infrastructure remains secure and compliant with future industry standards.