Get Started with ACME

Learn how to use ACME clients to automatically request, install, and renew SSL/TLS certificates for your ��Ƶ servers.

Essentials

Before installing a client, ensure your server environment meets the following conditions:

Ensure Port 80 is open in your firewall. The certproxy completes the HTTP-01 challenge by contacting your server to access a file automatically generated by the client. If this file is blocked, verification will fail.
- Note: If you are using a client in standalone mode, no other service can use Port 80 during the request. If you have an active web server running (like Apache), you must temporarily stop it.
Use as your ACME directory URL.

Client Installation and Configuration

Install an ACME client for your operating system. While any client adhering to the RFC 8555 protocol works, the following three are recommended:

Linux (Certbot)

Best for general Linux use. It automatically downloads certificate files, private keys, and chains to /etc/letsencrypt/live/your-certificate-name/.

Installation

RedHat/RHEL: yum install -y epel-release certbot
Debian/Ubuntu: apt-get install certbot

Use standalone mode for simple downloads or plugin mode for web server integration.

Standalone Request Command

certbot certonly \
  --standalone \
  --server [https://certproxy.andrew.cmu.edu/acme/acme/directory](https://certproxy.andrew.cmu.edu/acme/acme/directory) \
  --email your-email@andrew.cmu.edu \
  --agree-tos \
  --no-eff-email \
  --domains "your-domain.andrew.cmu.edu"

Linux (acme.sh)

A single-shell-script alternative to Certbot that provides similar core functionality.

Installation and Request Command

# Install client
curl https://get.acme.sh | sh -s email=your-email@andrew.cmu.edu
# or pull the script from GitHub
git clone https://github.com/acmesh-official/acme.sh.git


# Request certificate
./acme.sh --issue \
   --domain your-domain.andrew.cmu.edu \
 	 [--domain subject-alt-name.andrew.cmu.edu \
  	 --server https://certproxy.andrew.cmu.edu/acme/acme/directory \
  	 --standalone

Windows (Simple-ACME)

A drop-in successor to Win-ACME, installable via winget.

Installation

winget install simple-acme

Automated Certificate Installation

Configure your client to handle the certificate lifecycle.

Note: By default, standalone mode only downloads files to your disk; it does not bind them to services. You can automate installation using plugins or custom scripts.

Native Web Server Plugins

Instead of standalone mode, use native plugins to automatically configure web server bindings and avoid stopping your web server during renewals.

Apache (Linux)

dnf install -y python3-certbot-apache
certbot --apache -d your-domain.andrew.cmu.edu --server https://certproxy.andrew.cmu.edu/acme/acme/directory --agree-tos

Nginx (Linux)

dnf install -y python3-certbot-nginx certbot --nginx -d your-domain.andrew.cmu.edu --server https://certproxy.andrew.cmu.edu/acme/acme/directory --agree-tos

IIS (Windows Simple-ACME)

--installation iis --installationsiteid <id_number_of_iis_site>

Scripted Installations

For services without native plugins (like MSSQL or Oracle), pass an after-action script flag to handle deployment.

Certbot (Linux Deployment Hook): Add --deploy-hook /opt/ssl/install-ssl-cert.sh
Simple-ACME (Windows PowerShell Hook): Add --script install-ssl-on-windows.ps1

Automated Renewals

ACME clients automatically create cron jobs (Linux) or scheduled tasks (Windows) to monitor expiration and renew certificates before they lapse.

If you need to force a renewal immediately for a certificate that isn't near its expiration date yet, execute:

certbot renew --force-renewal
```

������Ƶ