ACME-based Certificate Management

The device supports the Automatic Certificate Management Environment (ACME) protocol to automate the process of obtaining, validating, and renewing TLS certificates for TLS Contexts.

Traditionally, managing TLS certificates is a manual, recurring task. For each certificate, you generate a certificate signing request (CSR), submit it to a Certificate Authority (CA), prove that you control the domain (often through email or manual DNS checks), and then install the issued certificate. You repeat this process every one to two years, before each certificate expires.

For large-scale device deployments, this manual burden multiplies across every domain and TLS Context you manage. Implementing ACME, the device automates this entire lifecycle - issuance, domain validation, and renewal - without your intervention.

ACME also enables much shorter certificate lifetimes. Instead of the traditional one-to-two-year renewal cycle, the device can renew certificates as often as every 60 days. Shorter-lived certificates reduce your exposure if a private key is ever compromised, improving your overall security posture.

The device acts as an ACME client and performs the following flow for each TLS Context you configure for ACME:

1.

Account setup. The device generates a key pair and registers an account with your chosen ACME CA. You configure this account as an ACME Profile. The device supports well-known public CAs such as Let's Encrypt and ZeroSSL, and also supports External Account Binding (EAB) for CAs that require it.

2.

Domain validation (challenge). The CA must confirm that you control the domain before it issues a certificate. The device supports the following challenge types:

●

HTTP-01: The device hosts a specific file at a URL on your domain, which the CA retrieves over HTTP.

●

DNS-01: The device creates a specific TXT record in your domain's DNS zone, which the CA queries. DNS-01 is required if you use wildcard domain names (e.g., *.example.com).

3.

Certificate issuance. Once the CA validates the challenge, the device submits an automatically generated CSR to the CA, and the CA issues the signed certificate.

4.

Renewal. The device repeats this flow automatically before each certificate expires. The device checks every hour whether the certificate of each ACME-enabled TLS Context is due for renewal:

●

Renewal is due when the certificate has consumed 'Auto Enroll Lifetime Percentage' of its validity period (percentage before expiration day).

●

If 'Maintenance Day of Week' or 'Maintenance Hour in Day' are configured, certificate renewal is deferred until this maintenance window.

Upon a successful certificate renewal, the device automatically installs the new private key, certificate, and CA chain in the TLS Context.

The device provides several tools to help you monitor ACME activity and troubleshoot issues. For more information, see :

■

ACME log file: Download this file from the TLS Contexts table. It contains the ACME issuance log for the most recent certificate issuance attempt for that TLS Context. For more information, see Downloading the ACME Log File.

■

Activity log: All ACME-related actions are logged in the device's Activity log (see Viewing Management User Activity Logs).

■

SNMP alarm: If the device fails to obtain or renew a certificate for a TLS Context after the configured number of retries, it raises the ACME Certificate Issue/Renewal Failed alarm (acACMERenewalFailedAlarm).