Summary of ACME Certificate Configuration

This section provides an overview of the settings required to obtain and manage certificates using ACME.

ACME configuration is configured in two tables:

Table	Purpose
ACME Profiles	Defines ACME server settings, including the CA directory URL, contact email address, External Account Binding (EAB) parameters, challenge type, and IP network interface. A single ACME Profile can be used by multiple TLS Contexts. For more information, Configuring TLS Contexts.
TLS Contexts	Enables ACME for a specific TLS Context and defines the certificate domain name, Subject Alternative Names (SANs), key algorithm, and certificate renewal policy. For more information, Configuring TLS Contexts.

Table

Purpose

ACME Profiles

Defines ACME server settings, including the CA directory URL, contact email address, External Account Binding (EAB) parameters, challenge type, and IP network interface. A single ACME Profile can be used by multiple TLS Contexts.

For more information, Configuring TLS Contexts.

TLS Contexts

Enables ACME for a specific TLS Context and defines the certificate domain name, Subject Alternative Names (SANs), key algorithm, and certificate renewal policy.

For more information, Configuring TLS Contexts.

➢

To obtain and manage certificates with ACME:

Configure an ACME Profile:

●

Configure the CA directory URL.

●

Configure any additional ACME server settings that the CA requires.

For more information, see Configuring ACME Profiles.

Upload DNS-01 Credentials:

If you use DNS-01 validation, upload the DNS provider credentials JSON file to the ACME Profile.

For more information, see Uploading DNS-01 Credentials to an ACME Profile.

Configure a TLS Context for ACME:

●

Enable the ACME client.

●

Select the ACME Profile.

●

Configure the certificate domain name and any required SANs.

●

Configure the certificate renewal policy.

For more information, see Configuring TLS Contexts.

Issue a Certificate:

●

Manually: Use the Issue ACME Certificate action. For more information, see Manually Triggering ACME Certificate Issuance.

●

Automatically: Allow the ACME renewal task to issue the certificate according to the renewal policy configured in the TLS Context.

After the initial certificate is issued, the device automatically renews the certificate before it expires by using the configured ACME Profile and renewal settings.