ACME

The Automatic Certificate Management Environment (ACME, RFC 8555) lets servers, containers and applications request and renew certificates automatically. It is the recommended method for Linux and web servers and for short-lived certificates, where manual CSR enrollment does not scale.

Availability: ACME is available on request. The customer's EC engagement lead arranges for it to be enabled for the required Issuing CA and certificate profile; EC then provides the ACME directory URL.

How ACME works with PKI-as-a-Service

An ACME client (for example certbot, acme.sh or cert-manager) registers an account with the PKI-as-a-Service ACME directory.
The client asks for a certificate for one or more DNS names and proves control of each name through a challenge.
The ACME service forwards the approved request to the EC Issuing CA, which signs the certificate.
The client installs the certificate and renews it automatically before it expires.

Prerequisites

The EC Root CA and Issuing CA certificates are trusted on the server (see Linux).
Outbound HTTPS (TCP 443) from the server to the ACME directory URL.
An ACME directory URL.
A certificate template or profile approved for ACME (for example TLS server, RSA 2048+ or ECDSA P-256, Server Authentication EKU).

Item	Value
ACME directory URL	Provided by EC when ACME is enabled, one directory URL per Issuing CA or certificate profile
Account binding	Not required (no External Account Binding)
Supported challenges	`http-01` and `dns-01` (use dns-01 for wildcard names)
Maximum validity	Set by the agreed certificate profile, up to 1 year (see Certificate Policy, TLS server profile)

Request a certificate with certbot

sudo certbot certonly --standalone \
  --server https://<acme-host>/directory \
  -d app.example.com --agree-tos -m [email protected]

# Test automatic renewal
sudo certbot renew --dry-run

Use --webroot -w <path> instead of --standalone when a web server is already listening on port 80.

Request a certificate with acme.sh

acme.sh --register-account --server https://<acme-host>/directory
acme.sh --issue --server https://<acme-host>/directory -d app.example.com -w /var/www/html

Kubernetes (cert-manager)

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: ec-pkiaas
spec:
  acme:
    server: https://<acme-host>/directory
    privateKeySecretRef:
      name: ec-pkiaas-account-key
    solvers:
      - http01:
          ingress:
            class: nginx

Operations

ACME-issued certificates appear in the portal Inventory like any other certificate and are covered by the expiry reports.
Revoke a certificate in the portal or with the client, for example certbot revoke --cert-path <file> --server <directory>.
Protect the ACME account key on each server; anyone with it can request certificates for that account.

Troubleshooting: If renewal fails, check that the server still trusts the EC chain, that outbound 443 to the ACME host is allowed, and that the challenge (port 80 for http-01, or the DNS record for dns-01) is reachable.

PKI-as-a-Service