RFC 8555 — ACME

Q: What does the Introduction section cover in RFC 8555 — ACME?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8555 — ACME. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Protocol Flow section cover in RFC 8555 — ACME?

The Protocol Flow section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8555 — ACME. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Challenge Types section cover in RFC 8555 — ACME?

The Challenge Types section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8555 — ACME. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Certificate Lifecycle section cover in RFC 8555 — ACME?

The Certificate Lifecycle section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8555 — ACME. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 8555 — ACME?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 8555 — ACME. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 8555 — ACME

Automatic Certificate Management Environment (ACME) — protocol for automating the issuance, renewal, and revocation of X.509 certificates, enabling zero-touch PKI operations at scale.

Standards Track March 2019 ISO 27001

1. Introduction

▶

ACME automates the domain validation and certificate issuance process that was traditionally manual. It is the protocol behind Let's Encrypt and other automated CAs, enabling organizations to deploy and rotate TLS certificates at scale.

ISO 27001 Relevance: A.8.24 (Use of Cryptography) — automated certificate lifecycle management ensures certificates are always valid and properly rotated. A.5.15 (Access Control) — automated validation ensures only authorized domain owners receive certificates.

2. Protocol Flow

▶

  ACME Client                           ACME Server (CA)
  ┌──────────┐                         ┌──────────────┐
  │ 1. Create│── POST /newAccount ──> │ Register     │
  │ Account  │<── 201 Created ───────│ Account      │
  │          │                         │              │
  │ 2. Order │── POST /newOrder ────> │ Create Order │
  │ Cert     │<── 201 + authz URLs ──│ + Challenges │
  │          │                         │              │
  │ 3. Prove │── Respond to ────────> │ Validate     │
  │ Control  │   challenge (HTTP/DNS) │ Domain       │
  │          │                         │              │
  │ 4. Submit│── POST /finalize ────> │ Issue Cert   │
  │ CSR      │<── Certificate ───────│              │
  └──────────┘                         └──────────────┘

3. Challenge Types

▶

Challenge	Method	Use Case
http-01	HTTP token at /.well-known/acme-challenge/	Web servers, standard deployments
dns-01	DNS TXT record _acme-challenge.domain	Wildcard certs, non-web services
tls-alpn-01	TLS ALPN extension on port 443	Environments where only 443 is available

4. Certificate Lifecycle

▶

Issuance: Typically 90-day certificates (forces automation)
Renewal: Auto-renew at 60 days (30-day buffer) — certbot, acme.sh
Revocation: POST to revocation URL with certificate and signature
Key rollover: Account key rotation supported via key-change resource

Best Practice: Short-lived certificates limit exposure window if a key is compromised. Automate renewal to prevent outages.

5. Security Considerations

▶

Account key security: Protect ACME account private key — it controls certificate issuance for all your domains
Challenge validation: Ensure challenge response files are cleaned up after validation
CAA records: Publish DNS CAA records to restrict which CAs can issue certificates for your domain
CT logs: Monitor Certificate Transparency logs for unauthorized certificate issuance
Rate limits: Be aware of CA rate limits — test with staging endpoint first