Available in Classic and VPC
Automated Certificate Management Environment (ACME) is a standard protocol defined in RFC 8555 to automate certificate issuance, validation, renewal, and revocation. Certificate Manager provides an ACME directory for the Enterprise Certificate product group, enabling you to build certificate renewal pipelines for your operating environment and automate certificate management.
Target audience for ACME
The ACME feature is ideal for customers who want to deploy certificates directly to their infrastructure and automate the renewal process. This prevents service disruptions caused by certificate expiration and allows customers to manage the certificate lifecycle without requiring manual intervention from administrators.
If you use certificates with Load Balancer or Global Edge on NAVER Cloud Platform, use the automatic certificate renewal feature in Certificate Manager instead of ACME.
ACME key features
Previously, when issuing or renewing a certificate, the person in charge had to submit an application directly to the certificate authority (CA) and manually install the issued file on the server. If you miss the renewal deadline or an error occurs during the process, it could lead to a service outage.
ACME is a standard protocol designed to automate this entire manual process. The client communicates directly with the certificate authority, handling everything from domain ownership validation to certificate issuance and renewal without human intervention. Various clients, such as Certbot, acme.sh, win-acme, and cert-manager, implement this standard, and you can select the client that best suits your operating environment.
ACME in Certificate Manager offers these key features:
- Automated lifecycle management: Integration features enable clients in each operating environment to handle the entire process automatically, from certificate requests and issuance to deployment and renewal. This minimizes the need for manual intervention by the operator.
- \Organization validation (OV) certificate support: Automate the management of higher-assurance OV certificates, unlike typical free ACME services such as Let's Encrypt, which support only domain validation (DV).
- Standard client compatibility: Support for RFC 8555-compliant clients, including Certbot, acme.sh, win-acme, and cert-manager, standardizes certificate management across environments and simplifies operations.
Basic ACME workflow
The ACME protocol operates in 3 stages: Account registration (EAB), domain ownership validation (Challenge), and certificate issuance (Order). After you complete the initial setup and configure scheduling (e.g., crontab), the client automatically renews certificates in time for expiration.
- Account registration (EAB): Register and authenticate the client with the ACME server using External Account Binding (EAB) information.
- Domain ownership validation (Challenge): Prove control over the domain, typically through DNS records.
- Certificate issuance and renewal (Order): Once validation is complete, the certificate is issued, and the client then repeats the renewal process according to the configured schedule.
ACME service specifications
ACME service specifications are listed below.
| Item | Specifications |
|---|---|
| Certificate type | Advanced DV, Advanced OV |
| Validation method | DNS-01 challenge (dynamic validation and prevalidation) |
| Compatible clients | All RFC 8555-compliant clients |
| Encryption algorithms | RSA 2048 |
| ACME Directory URL | https://acme.navercloudtrust.com/acme/directory |
Compare domain validation methods
The following tables compare the domain validation methods supported by ACME.
DNS-01 dynamic validation
| Item | Details |
|---|---|
| Description | Performs dynamic domain validation through the ACME protocol for each issuance and renewal. |
| Automation conditions | Requires an Ncloud Global DNS API integration script or a Certbot DNS plugin. |
| Wildcard support | Supported |
Prevalidation
| Item | Details |
|---|---|
| Description | Reuses DNS TXT validation completed in advance in the Domains menu of Certificate Manager. |
| Automation conditions | Handled automatically by the client without the need to modify any DNS records. |
| Wildcard support | Supported |
Guides by deployment environment
ACME can be used primarily in the following environments:
- Standalone servers: Environments where you configure and manage certificates directly on server operating systems such as Linux and Windows.
- Containers: Environments where tools such as cert-manager automate certificate renewal in Kubernetes.
- Multicloud: Environments that combine other cloud infrastructure, such as AWS, and require consistent certificate deployment and management.
The following explains how to configure each environment:
| Environment | Description |
|---|---|
| Linux server | Integrate Certbot with an Ncloud Global DNS hook script to fully automate certificate issuance and renewal on standalone servers. |
| Windows server | Configure automation for certificate issuance and renewal in a Windows server environment using win-acme. |
| Kubernetes | Automate certificate lifecycle management for Kubernetes Ingress and Pods using cert-manager's ClusterIssuer. |
| AWS EC2 + ACM | Use the deploy hook in acme.sh to automatically import the issued certificate into AWS Certificate Manager (ACM) and apply it to the Application Load Balancer (ALB). |
For detailed configuration instructions for each environment, see these guides:
- Linux server certificate automation with Certbot: Learn how to automate certificates on Linux servers by integrating Certbot with Ncloud Global DNS.
- Windows Server certificate automation with win-acme: Learn how to automate certificates on Windows servers using win-acme.
- Configure ACME in Kubernetes: Learn how to automate certificates in Kubernetes using cert-manager ClusterIssuer.