ACME (Automatic Certificate Management Environment) is an open standard (RFC 8555) that lets a server obtain and renew SSL certificates without human intervention. As certificate lifetimes get shorter, automatic renewal is becoming a must.
In short
- On webevi hosting, Let's Encrypt certificates renew automatically via ACME.
- As long as your domain points to our server, you do not need to do anything.
How does ACME work?
- The ACME client on the server opens an account with the certificate authority and states which domains need a certificate.
- The authority asks you to prove that you control the domain: HTTP-01 (a temporary file on your site), DNS-01 (a temporary TXT record; required for wildcards) or TLS-ALPN-01.
- If validation succeeds, the certificate is issued and installed automatically.
- When about two thirds of its lifetime has passed, the client repeats the process by itself.
Certificate lifetimes are getting shorter
The CA/Browser Forum ballot adopted in April 2025 (SC-081v3) covers all public SSL certificates, free and paid:
| Issued | Maximum validity | Renewal frequency |
|---|---|---|
| Before 15 March 2026 | 398 days | Once a year |
| From 15 March 2026 | 200 days | Twice a year |
| From 15 March 2027 | 100 days | 4 times a year |
| From 15 March 2029 | 47 days | About 8 times a year |
Let's Encrypt's default lifetime is also dropping from 90 days to 64 days on 10 February 2027 and to 45 days on 16 February 2028. Sites with working automatic renewal will not notice the change.
Why does automatic renewal fail?
- The domain points to another server
- If DNS records changed, validation fails. Check your DNS records.
- A proxy such as Cloudflare is on
- The validation request may not reach our server. Manage the certificate in Cloudflare or turn the proxy off.
- The .well-known folder is blocked
- .htaccess rules, security or maintenance-mode plugins can block the validation file.
- A CAA record does not allow it
- Your CAA record must include
letsencrypt.org. - No DNS record for www
- Every name in the certificate needs a valid DNS record.
Frequently asked questions
- Will I get an email before expiry?
- Let's Encrypt stopped sending expiry reminder emails in June 2025. You can check your site now and then with our SSL Checker.
- What about my manually installed paid certificate?
- New certificates are valid for at most 200 days, and 100 days after March 2027. You will need to reinstall several times a year; our support team can help.
- How do I use ACME on my own server (VDS)?
- Certbot or acme.sh on Linux and win-acme on Windows/IIS are popular free clients.
- My certificate did not renew. What should I do?
- Start the renewal manually on the SSL/TLS Certificates page in Plesk. If the problem continues, open a support ticket with your domain name.
Need help? Open a support ticket from your client area or call +90 216 348 35 03.
