Acme In One Word

Yan Naigebaver

3 min read

·

Jun 20, 2026

--

Listen

Share

Acme is an open source project that’s made to reduce the amount of networking traffic survielence.

The traffic survielence is monitored by tech corporate giants holding DNS registries like google, recording where each device is trying to reach.

A group of independent developers made ACME to provide free encryption for web traffic and increase traffic privacy.

As of now there are more than 700 Million Sites serving traffic via ACME certificates.

Press enter or click to view image in full size

How ACME Works?

We’ll discuss two important protocols implemented by the acme scheme.

1. DNS-01
2. HTTP-01

DNS-01:

To use this protocol it is required that you have the following abilities:

1. Edit TXT records under your dns records.
2. Connect via HTTP to acme servers.

In this protocol the client attempts a challenge where he proves that the DNS zone for which he tries to create a signed certificate for is indeed his own. The client must prove that he can write TXT records under his DNS zone.

How DNS-01 Protocol Flows:

1. Client attempts to generate signed certificate for zone node3.<dc1>.<dc2> by invoking the HTTP web request to acme.<x>.<y>:9000/acme/acme/directory/<issue-request>
2. The acme server responds with the name of the TXT record to apply, and the value of the TXT record. Name: _acme-challenge.node3.homedc.labtest . Value: “pitf_IQ6pOrzigKurSZ2vgQ9TWMWuy0dQV0HnZb2BzM”
3. The client must create and edit the TXT record with the appropriate challenge value to be able to continue the process.
4. The client then sends a request for the certificate with the request identifier.
5. The acme server verifies that the challenge was written successfully to the DNS TXT record and generates the signed certificates.

HTTP-01:

To use this protocol it is required that you have these abilities:

1. Access to the server that’s assigned the DNS record for which the certificate is signed for.
2. HTTP server listening on port 80.
3. Access via http to the acme server.

How HTTP-01 Protocol Flows:

1. The client recieves challenge token from the ACME server which looks like this:

2. Addionally the client holds an account key which is shared only via the server and the client. The client uses challenge token with the account key to generate the a token that validates the client called authorization token.

3. The client must write to a well known path in the corresponding HTTP web server the authorization token, as the name of the file will be the token it recieved from acme server.

4. The client informs the acme server that it can now check for the file via http request.

5. The server sends a GET /.well-known/acme-challenge/LoqXcYV8…jxAjEuX0 and validates that the content is the authorization key.

6. If the content match the server responds with the signed certificates.

Thanks for reading, Cheers!

Sources:

1. https://datatracker.ietf.org/doc/html/rfc8555/#autoid-45
2. https://www.youtube.com/watch?v=Gksq9Tx92j0&t=51s
3. https://www.youtube.com/watch?v=k73MNzoel7Q
4. https://letsencrypt.org/2020/02/27/one-billion-certs
5. https://letsencrypt.org/2025/12/09/10-years.html
6. https://www.freeipa.org/page/Documentation.html
7. https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode
8. https://smallstep.com/docs/step-ca/provisioners/#choosing-a-provisioner