ACME Automation for Short-Lived Certificates: Building Infrastructure That Scales to 47-Day Lifetimes

At 398-day lifetimes, annual manual renewal is tedious but survivable. At 47-day lifetimes (from 2029), you're renewing every certificate roughly every 30 days (best practice: renew at 2/3 of lifetime). For an organization with 500 public certificates, that's 500 renewals per month. Manual processes collapse. ACME automation is the only path forward.

What ACME Provides

ACME (Automatic Certificate Management Environment, RFC 8555) is the protocol that powers Let's Encrypt and is supported by most commercial CAs:

• Automated domain validation — HTTP-01 or DNS-01 challenges verified programmatically
• Automated certificate issuance — CSR submission, validation, and certificate download without human interaction
• Automated renewal — Client monitors expiration and renews before deadline
• Standardized protocol — Works with Let's Encrypt, ZeroSSL, Buypass, Google Trust Services, DigiCert, Sectigo, and more

ACME Implementation Patterns

Pattern 1: Web Server Native (Simplest)

Certbot or acme.sh running on each web server. Best for: simple deployments, single-server applications, traditional hosting.

• Install certbot alongside nginx/Apache
• Configure HTTP-01 challenge (or DNS-01 for wildcards)
• Cron job handles renewal (certbot renew)
• Post-renewal hook reloads the web server

Pattern 2: Centralized ACME Client

A single ACME client manages certificates for multiple endpoints. Best for: load-balanced environments, CDNs, API gateways.

• Central service requests certificates via DNS-01 (no per-server HTTP challenge needed)
• Distributes certificates to target systems via API, configuration management, or secrets manager
• Single point of monitoring and alerting

Pattern 3: Kubernetes cert-manager

For containerized infrastructure, cert-manager is the standard:

• Declares certificates as Kubernetes resources
• Supports Let's Encrypt, Vault, Venafi, and custom ACME CAs
• Automatic renewal based on configurable threshold
• Stores certificates as Kubernetes Secrets
• Integrates with ingress controllers for automatic HTTPS

Pattern 4: DNS-01 with Cloud DNS

For organizations with many domains and subdomains: ACME client with DNS-01 challenge via cloud DNS API (Route53, Cloud DNS, Azure DNS). Supports wildcard certificates. No per-server configuration needed. Centralized management.

DCV Reuse Implications

The CA/Browser Forum is also reducing Domain Control Validation reuse periods to as little as 10 days by 2029. This means your ACME client must be prepared to complete domain validation challenges more frequently — not just certificate issuance. Ensure your DNS-01 or HTTP-01 infrastructure is robust and automated.

Testing Your Automation

Use Let's Encrypt's staging environment to test renewal cycles without hitting rate limits. Simulate certificate expiration by setting short-lived test certificates. Monitor for: successful renewal, web server reload, zero-downtime rotation, and alerting on failure.