AcmeMux Sponsor

Live dogfood

Come back in a few days and the certificate should be different.

The public site runs on Azure App Service. A private AcmeMux instance evaluates its native lego workspace every day and targets a fresh certificate about every 72 to 96 hours. A separate least-privilege deployer validates and activates each change.

acmemux.com and www.acmemux.comLoading

Expected next certificate replacement

Loading certificate statusLoading
0 percent
ACME profile
Loading
Issued
Loading
Expires
Loading
Last deployed
Loading
SHA-256 fingerprint
Loading

Public certificate metadata only.

What to verify

The dates and fingerprint are the receipt.

Record the issued date or fingerprint shown here, then return after the countdown. A successful cycle will show a newer start date, a later expiration date, and a different public leaf fingerprint.

The browser receives only public certificate metadata. It never connects to AcmeMux, Azure management APIs, AWS APIs, or the private operator host.

Read the security model

One-time renewal alert

Let the certificate call you back.

Enter an email address and confirm the message from AWS Notifications. After the next certificate is issued, deployed, and verified on the public site, the notification will include the new issued date and fingerprint. The topic is then reset and the address is removed.

  • One renewal result, not a newsletter
  • No analytics, tracking pixel, or CAPTCHA
  • AcmeMux stores only hashed abuse-limit keys, not the address
  • The entire notification cycle expires after 14 days

AWS confirmation is required and includes its standard unsubscribe flow.

Deliberately accelerated

A visible renewal cycle with room below the rate limit.

Why 72 to 96 hours

The certificate still uses Let's Encrypt's classic profile. AcmeMux runs one daily evaluation and the lego configuration makes the certificate eligible when 87 days remain. Depending on issuance time, the daily schedule, and lego's renewal coordination, replacement should occur roughly three to four days after issuance.

Let's Encrypt permits up to five certificates for the exact same identifier set in seven days and replenishes that capacity at one certificate every 34 hours. This demonstration targets about two per week, leaving room for recovery while avoiding a wasteful daily order. It is an intentional dogfood setting, not a general production recommendation. Read the current rate limits.

The roughly six-day shortlived profile remains on the roadmap. AcmeMux does not claim support until the field, renewal behavior, and recovery path are reviewed and tested.

Certificate path

Issuance and deployment remain separate.

  1. 1

    Daily evaluation

    AcmeMux runs a durable daily whole-workspace operation against the reviewed lego runtime.

  2. 2

    Renewal eligibility

    lego evaluates the configured 87-day threshold, ACME Renewal Information, and its normal safeguards before ordering.

  3. 3

    DNS-01 and validation

    lego uses a least-privilege Route 53 identity. The deployer then checks hostnames, validity, and key correspondence.

  4. 4

    Served-leaf verification

    Deployment succeeds only after both public hostnames serve the expected new fingerprint.