The encyclopedia · Software & IT · Technical decision · 2015–2019
ACME made certificate issuance a machine protocol, so HTTPS became automatic
IETF's ACME protocol (RFC 8555) lets a server prove domain control and renew HTTPS certificates with no human step; Let's Encrypt built its CA on it.
IETF · Internet Security Research Group (Let's Encrypt)
The solution
Before ACME, getting an HTTPS certificate meant proving domain control through human processes — forms, emails, phone calls — then installing it by hand and re-issuing before expiry. The IETF's RFC 8555, published as a Proposed Standard in March 2019, defines the Automatic Certificate Management Environment: a protocol that a certificate authority and an applicant use to automate verification, issuance and revocation.
The design turns validation into a machine challenge. The client generates an account key, asks the CA what it must do to prove control of the domain, completes an automated challenge, and receives the certificate — no human in the loop. Renewal and revocation ride the same protocol, so a server can keep its certificates current on a schedule.
Let's Encrypt states the objective plainly: make it possible to set up an HTTPS server and have it automatically obtain browser-trusted certificates without any human intervention, by running an ACME client on the web server. The free CA that wanted HTTPS everywhere built its entire service on the protocol.
Why it worked
- Validation became an automated challenge a server could answer, not a human form.
- Account keys let clients prove identity without a per-user login ceremony.
- The protocol is CA-agnostic, so any issuer can implement the same client.
- Automated renewal removed the expired-certificate outage that manual re-issuance caused.
What can be applied
Standardize the painful step — proving you own the domain — as a machine-readable protocol, and the whole workflow automates; the bottleneck was process, not price.
Aftermath
With ACME, Let's Encrypt's free service made obtaining browser-trusted certificates a human-free step, and RFC 8555 gave every CA a standard way to offer the same automation. Certificate renewal turned from a calendar chore into a background job that runs itself.
Sources
spotted an error? The archive wants to know.