An ACME client is a software tool that automates SSL Certificate management by talking to a Certificate Authority (CA) using the Automatic Certificate Management Environment (ACME) protocol. It handles the whole lifecycle of an SSL Certificate, from the first request through to each automatic reissue.
The client validates domain control, requests the SSL Certificate, installs it, and reissues it before it expires. With Trustico® Certificate as a Service (CaaS), it does all of this using your External Account Binding (EAB) credentials, so nothing needs to be done by hand.
The ACME Client Workflow
Every ACME client follows the same standard process, which is what allows the work to be fully automated. The steps are always the same, whichever client you choose. Learn About The ACME Protocol 🔗
The client first registers an account with the Certificate Authority (CA) using your External Account Binding (EAB) credentials, which authenticate your active Trustico® Certificate as a Service (CaaS) license. It then proves you control the domain through one of the standard validation methods.
Once validation passes, the Certificate Authority (CA) issues the SSL Certificate and the client installs it on your web server or saves it to a location you specify. The client then tracks the expiry date and reissues automatically, well before the SSL Certificate runs out.
Popular ACME Clients
Several well-established ACME clients are available, and all of them work with Trustico® Certificate as a Service (CaaS). They follow the same protocol but differ in their features, their installation, and the audience they suit best.
Certbot
Certbot is the most widely used ACME client, developed by the Electronic Frontier Foundation. It has thorough documentation and strong community support, and it is recommended by many Certificate Authorities.
Certbot runs on Linux, macOS, and Windows, with built-in support for web servers such as Apache and Nginx. It can configure your web server with a new SSL Certificate for you, or simply save the files for manual installation. Visit the Certbot Website 🔗
Certbot accepts your External Account Binding (EAB) credentials through command line options, which makes it a good fit for Trustico® Certificate as a Service (CaaS).
acme.sh
acme.sh is a lightweight client written as a shell script, so it runs on almost any Unix-like system. It is popular with system administrators who want minimal dependencies and wide compatibility.
It supports many Domain Name System (DNS) providers for automated validation, and it can deploy SSL Certificates to a range of services on its own. Visit the acme.sh Repository 🔗
It has solid support for External Account Binding (EAB) credentials and works with Trustico® Certificate as a Service (CaaS) through environment variables.
Lego
Lego is a modern client written in Go that compiles to a single binary, which makes it easy to move between systems. It supports many Domain Name System (DNS) providers and cloud platforms.
Lego suits containers and cloud deployments well, because it is self-contained and needs no external dependencies. Visit the Lego Repository 🔗
Lego provides dependable External Account Binding (EAB) support and works well with Trustico® Certificate as a Service (CaaS) in automated deployments.
win-acme
win-acme is built for Windows and Internet Information Services (IIS). It gives Windows administrators a friendly interface for both first-time setup and ongoing automation.
It offers both interactive and automated modes, which suits initial setup as well as unattended SSL Certificate management on Windows servers. Visit the win-acme Repository 🔗
win-acme accepts External Account Binding (EAB) credentials and fits neatly into Windows-based Trustico® Certificate as a Service (CaaS) deployments.
Choosing the Right ACME Client
The best client depends on your operating system, your web server, and how much you want to configure by hand. A few simple guidelines cover most situations.
Certbot is the easiest starting point, with the best documentation and automatic web server configuration. For system administrators who want flexibility and few dependencies, acme.sh is a strong choice.
For cloud and container deployments, the single binary of Lego fits neatly into automated pipelines. For Windows and Internet Information Services (IIS), win-acme provides native integration.
Tip : If your website runs on cPanel, the Trustico® Certificate as a Service (CaaS) cPanel Plugin brings automated SSL Certificate management directly into your hosting control panel, without the command line. It retrieves, installs, and reissues your SSL Certificates from within cPanel itself. Explore the Trustico® cPanel Plugin 🔗
Whichever client you pick, the setup uses the same External Account Binding (EAB) credentials, which the next section explains.
Setting Up EAB Credentials
Every modern ACME client supports the External Account Binding (EAB) credentials that Trustico® Certificate as a Service (CaaS) requires. Setup means giving your client three values, your EAB Key Identifier, your EAB Message Authentication Code (MAC) Key, and the ACME server address. Learn About External Account Binding (EAB) Credentials 🔗
Most clients ask for these details when you first register the account. After that, the client can request and reissue SSL Certificates on its own for the domains you authorize. The examples below show the basic commands for the most common clients.
Configuring Certbot
Register your Certbot account with your External Account Binding (EAB) credentials using this command.
certbot register --server YOUR_ACME_SERVER_URL --eab-kid YOUR_EAB_KEY_ID --eab-hmac-key YOUR_EAB_MAC_KEY --email your@email.com
After registration, request SSL Certificates as normal with the certbot certonly or certbot run commands.
Configuring acme.sh
Set environment variables for your External Account Binding (EAB) credentials.
export ACME_EAB_KID="YOUR_EAB_KEY_ID"
export ACME_EAB_HMAC_KEY="YOUR_EAB_MAC_KEY"
Then register your account against the ACME server address.
acme.sh --register-account --server YOUR_ACME_SERVER_URL
Configuring Lego
Pass your External Account Binding (EAB) credentials as command line parameters.
lego --server YOUR_ACME_SERVER_URL --eab --kid YOUR_EAB_KEY_ID --hmac YOUR_EAB_MAC_KEY --email your@email.com --domains example.com run
Lego completes registration and requests the SSL Certificate in a single command.
ACME Client Installation Methods
You can install an ACME client in several ways, depending on your operating system and how you prefer to manage software. Most clients offer more than one option.
System package managers are the simplest route on most platforms, installing and updating the client alongside your other software. Pre-compiled binaries are available for clients such as Lego and win-acme, which avoids any need to compile.
More advanced users can build a client from source for the latest features, and container images let you run most clients inside a containerized environment with little setup.
Automating SSL Certificate Issuance
The main benefit of an ACME client is that it handles domain validation and SSL Certificate issuance for you, for as long as your Trustico® Certificate as a Service (CaaS) license is active. Explore Certificate as a Service (CaaS) 🔗
A client usually starts working on a replacement around 30 days before an SSL Certificate expires, which leaves plenty of time to fix any problem. Schedule the client to run daily or weekly, and it will only act on SSL Certificates that are close to expiry.
Test the process from time to time, so you know it works with your Trustico® Certificate as a Service (CaaS) before an SSL Certificate is actually due.
Domain Validation Methods
An ACME client proves you control a domain in one of three standard ways. You choose the one that fits your infrastructure, and the client handles it at every reissue. Learn About The Validation Procedure 🔗
The file based method places a file on your web server for the Certificate Authority (CA) to retrieve, and it needs port 80 to be reachable. The Domain Name System (DNS) method adds a TXT record instead, which works behind a firewall and is the only method that can issue a wildcard SSL Certificate.
The third method proves control through a short exchange on port 443, which helps when port 80 is closed. Your client selects and completes whichever method you have configured.
Troubleshooting Common ACME Client Issues
Most problems come down to network access, domain validation, or configuration. Knowing the usual causes makes them quick to resolve.
If authentication fails, check that your External Account Binding (EAB) credentials are correct, that your Trustico® Certificate as a Service (CaaS) license is active, and that you are using the right ACME server address. If validation fails, confirm that your domain points to the correct server and that any firewall allows the ports your chosen method needs.
Certificate Authorities apply rate limits to prevent abuse, so avoid repeated or duplicate requests. If the client cannot write files, check that it has permission to save SSL Certificates and validation files to the locations it needs.
Advanced ACME Client Features
Beyond basic issuance and reissue, most clients offer features that help them fit into larger systems.
Hooks let you run your own scripts before and after each SSL Certificate operation, which is useful for deployment pipelines and alerts. Many clients can also cover several domains or subdomains in a single SSL Certificate, which simplifies management.
Some clients manage Domain Name System (DNS) records automatically for validation through provider interfaces, and many can deploy a finished SSL Certificate to load balancers, Content Delivery Networks (CDNs), and other services on their own.
Getting Support for ACME Clients
Each ACME client has its own documentation, community forums, and issue tracker, which are the best first stop for questions about that specific client.
For anything specific to Trustico® Certificate as a Service (CaaS), our support team can help with External Account Binding (EAB) authentication and configuration. When you get in touch, include your client version, operating system, and any error messages, and never share your External Account Binding (EAB) Message Authentication Code (MAC) Key.
Keeping Your Service Active
Automated SSL Certificate management through Trustico® Certificate as a Service (CaaS) works only while your license is active. As long as it stays current, your client keeps reissuing SSL Certificates and your sites stay protected.
To avoid any gap, keep your Trustico® Certificate as a Service (CaaS) license current before it expires, or set up automatic billing so it continues without interruption. If the license lapses, your client can no longer reissue, and an SSL Certificate that expires will take the site offline until the license is restored.
