The padlock icon in your website's address bar appears thanks to a valid SSL/TLS certificate. The validity of these certificates is getting a little shorter every year, and renewing them by hand is getting harder. In this article we explain the ACME protocol, which obtains and renews certificates automatically, what it means for you, and common problems.
What is ACME?
ACME (Automatic Certificate Management Environment) is an open standard (RFC 8555) that lets a server obtain, renew and, when needed, revoke an SSL certificate from a certificate authority (CA) without human intervention. It was first developed for the free certificate provider Let's Encrypt; today many paid certificate providers also offer ACME support.
In short: thanks to ACME, you don't have to keep track of your certificate's expiry date, order a new certificate and install it on the server. Software on the server (the ACME client) does this for you.
How does ACME work?
- Account creation: The ACME client on the server opens an account with the certificate authority.
- Certificate request: The client states which domains the certificate is requested for (e.g.
example.comandwww.example.com). - Domain validation: The certificate authority asks you to prove that the domain really is under your control. There are three methods for this:
- HTTP-01: A temporary file is placed in your site's
/.well-known/acme-challenge/folder, and the authority reads this file over the internet. This is the most common method. - DNS-01: A temporary TXT record named
_acme-challengeis added to the domain's DNS. Wildcard (*.example.com) certificates can only be obtained with this method. - TLS-ALPN-01: Validation is done over port 443 with a special TLS connection. It is mostly used in special setups.
- HTTP-01: A temporary file is placed in your site's
- Certificate issuance: If validation succeeds, the certificate is issued and the client installs it on the server automatically.
- Automatic renewal: When about two thirds of the certificate's lifetime has passed, the client repeats the same process by itself.
Why is it so important now?
In April 2025 the CA/Browser Forum, made up of browser makers and certificate authorities, adopted a decision (SC-081v3) that gradually shortens the maximum validity of SSL certificates. This rule covers all public SSL certificates, free and paid, including DV, OV and EV:
|
Date the certificate is issued |
Maximum validity |
Approximate renewal frequency |
|---|---|---|
|
Before 15 March 2026 |
398 days |
Once a year |
|
From 15 March 2026 (currently in force) |
200 days |
Twice a year |
|
From 15 March 2027 |
100 days |
4 times a year |
|
From 15 March 2029 |
47 days |
About 8 times a year |
The period for which a domain validation can be reused is shortening on the same schedule, dropping to 10 days in 2029. In other words, in the near future renewing certificates by hand will not be practical; automation (ACME) is becoming a necessity, not an option.
The free certificate provider Let's Encrypt has also announced its own schedule: the default certificate lifetime, 90 days today, drops to 64 days on 10 February 2027, to 45 days on 16 February 2028. For sites where automatic renewal works properly, this change happens without anyone noticing.
How is ACME used at Webevi?
In Webevi hosting packages, free SSL certificates are obtained and renewed automatically with ACME:
- In cPanel packages: The AutoSSL feature automatically issues certificates for the domains in your account and renews them before they expire. In cPanel you can see the status on the SSL/TLS Status screen.
- In Plesk packages: With the Let's Encrypt extension (SSL It!) a certificate is obtained in one click; renewal happens by itself as long as the "Renew automatically" option is on.
As long as your domain's DNS records point to Webevi servers, you usually don't need to do anything.
Why does automatic renewal fail?
If your certificate was not renewed, these are the most common reasons:
- The domain points to another server: If the DNS records have been changed or the domain has been pointed to another service, validation fails.
- A proxy/CDN such as Cloudflare is in use: While the proxy is on, the validation request may not reach your server. In that case you need to manage the certificate on the Cloudflare side or use the DNS-01 method.
.well-knownAccess to the folder is blocked:.htaccess/web.configredirect rules, security plugins or "maintenance mode" plugins can block the validation file.- A CAA record does not allow it: If your DNS has a CAA record, the certificate authority used (e.g.
letsencrypt.org,sectigo.com) must be listed in that record. wwwor a subdomain is missing a DNS record: Every name added to the certificate must have a valid DNS record.- The domain has expired or been suspended: In this case validation cannot be done.
- Too many attempts were made: Certificate authorities limit how many certificates can be issued within a certain period. After repeated failed attempts you may need to wait a while.
Frequently asked questions
Is a certificate obtained with ACME free? Certificates from providers such as Let's Encrypt are free. ACME is a protocol; some paid certificate providers also offer automatic renewal with ACME.
Is there a security difference between a free and a paid certificate? There is no difference in encryption strength. Paid certificates offer extras such as organization validation (OV/EV), a warranty and support. Where your organization's identity needs to appear in the certificate, a paid certificate may be preferred.
Can a wildcard certificate be obtained with ACME? Yes, but only with the DNS-01 method. For this, your DNS must be managed in a system that can add the _acme-challenge TXT record automatically (e.g. our hosting panel or a DNS provider with API support).
Will I get an email when my certificate is about to expire? Let's Encrypt stopped sending expiry reminder emails in June 2025. That is why it is important to make sure automatic renewal is working. If you see a problem, you can contact our support team.
What about the paid certificate I installed by hand? Certificates issued now are valid for at most 200 days; after March 2027 this drops to 100 days. If you install certificates by hand, you will need to renew several times a year. To reduce this burden, we recommend switching to an ACME-based solution.
How do I use ACME on my own server (VDS/VPS)? On Linux servers, Certbot or acme.sh, and on Windows/IIS servers win-acme are commonly used free ACME clients. After installation, renewal runs automatically as a scheduled task.
My certificate was not renewed. What should I do? First check that your domain's DNS records point to the Webevi server and that your site opens over http://. Then trigger the renewal manually from your panel (cPanel: SSL/TLS Status → Run AutoSSL; Plesk: SSL It! → Renew). If the problem persists, open a support ticket and tell us your domain.
