AcmeMux Sponsor

Live dogfood

Come back in a few days and the certificate should be different.

The public site runs on Azure App Service. A private AcmeMux instance evaluates its native lego workspace every day and targets a fresh certificate about every 72 to 96 hours. A separate least-privilege deployer validates and activates each change.

acmemux.com and www.acmemux.comLoading

Expected next certificate replacement

Loading certificate statusLoading
0 percent
ACME profile
Loading
Issued
Loading
Expires
Loading
Last deployed
Loading
SHA-256 fingerprint
Loading

Public certificate metadata only.

What to verify

The dates and fingerprint are the receipt.

Record the issued date or fingerprint shown here, then return after the countdown. A successful cycle will show a newer start date, a later expiration date, and a different public leaf fingerprint.

The browser receives only public certificate metadata. It never connects to AcmeMux, Azure management APIs, AWS APIs, or the private operator host.

Read the security model

Skeptical?

Hold us to the countdown.

Leave an email address and confirm the message from AWS Notifications. Within a few minutes after this countdown reaches zero, we will remind you to come back and decide for yourself whether AcmeMux succeeded, failed, or is still catching up.

  • One reminder, not a newsletter or a success claim
  • No analytics, tracking pixel, or CAPTCHA
  • AcmeMux stores only a temporary hashed abuse-limit key, not the address
  • After the reminder, every subscription and hashed email key is deleted

Once the reminder is sent, your subscription and hashed email key are deleted. Your address is never used to contact you for anything except this one alert. AWS confirmation is required.

Deliberately accelerated

A visible renewal cycle with room below the rate limit.

Why 72 to 96 hours

The certificate still uses Let's Encrypt's classic profile. AcmeMux runs one daily evaluation and the lego configuration makes the certificate eligible when 87 days remain. Depending on issuance time, the daily schedule, and lego's renewal coordination, replacement should occur roughly three to four days after issuance.

Let's Encrypt permits up to five certificates for the exact same identifier set in seven days and replenishes that capacity at one certificate every 34 hours. This demonstration targets about two per week, leaving room for recovery while avoiding a wasteful daily order. It is an intentional dogfood setting, not a general production recommendation. Read the current rate limits.

The roughly six-day shortlived profile remains on the roadmap. AcmeMux does not claim support until the field, renewal behavior, and recovery path are reviewed and tested.

Certificate path

Issuance and deployment remain separate.

  1. 1

    Daily evaluation

    AcmeMux runs a durable daily whole-workspace operation against the reviewed lego runtime.

  2. 2

    Renewal eligibility

    lego evaluates the configured 87-day threshold, ACME Renewal Information, and its normal safeguards before ordering.

  3. 3

    DNS-01 and validation

    lego uses a least-privilege Route 53 identity. The deployer then checks hostnames, validity, and key correspondence.

  4. 4

    Served-leaf verification

    Deployment succeeds only after both public hostnames serve the expected new fingerprint.