ACME profiles
Let's Encrypt short-lived certificates
Understand the roughly six-day profile, renewal and deployment requirements, ARI, rate limits, and current AcmeMux support.
Learn
Certificate automation is infrastructure, not housekeeping.
These guides explain the ACME, DNS, credential, scheduling, deployment, and recovery concepts that make automated certificates dependable.
12 minute read
Foundation
ACME DNS-01 challenge explained
Understand the validation transaction, wildcard certificates, TXT propagation, delegated challenge zones, and least-privilege API design.
Operations
Operating the lego ACME client safely
Move from a successful command to a maintainable native workspace with clear ownership, credentials, schedules, and recovery behavior.
Reliability
Certificate renewal automation without hidden failure
Design around ARI, random delay, idempotency, propagation, atomic deployment, observation, and uncertain external outcomes.
Provider guide
Let's Encrypt DNS-01 with Amazon Route 53
Plan hosted-zone targeting and an IAM policy limited to the TXT records needed for validation.
Use primary sources
CA policy, ACME RFCs, provider documentation, and upstream lego behavior are more authoritative than a copied command in a blog post.
Separate issuance from deployment
Obtaining certificate files and safely activating them in a reverse proxy or load balancer are different transactions with different rollback needs.
Design for uncertainty
External APIs can succeed after your process loses the response. Reliable automation observes current state before replaying a potentially destructive step.