How does ACME work?
ACME is a standard used by certificate-management software to communicate with a certificate authority. It is not the name of an issuer or a different kind of encryption. The protocol is specified in RFC 8555.
- Choose the namesThe client connects to the issuer for specific names, such as example.com and www.example.com.
- Prove controlThe issuer checks a validation response served over HTTP or published in DNS.
- Obtain the certificateThe client prepares the request, downloads the certificate and passes it to the configured installer.
- Renew automaticallyA schedule checks expiry and requests a replacement in time.
Issuing a certificate and serving it on your website are separate steps. After installation, check the certificate actually presented over HTTPS. An “issued” status alone does not confirm that the server is using the replacement.
HTTP-01 or DNS-01?
HTTP-01 uses a response at a designated path on the web server. The name must point to the correct server and validation access must not be blocked. DNS-01 uses a TXT record under _acme-challenge. Automated renewals need an appropriate DNS integration; manually entering the record at each validation does not provide full automation.
Let's Encrypt uses DNS-01 for wildcard certificates. For other services, confirm the supported validation method and product scope as well. See ACME challenge types. A wildcard for *.example.com does not replace a separate entry for example.com.
A year of service is not one year-long certificate
Certificate validity is the expiry date inside a particular certificate. The paid service term defines how long you can use the entitlements included in the product. Automation may obtain several successive certificates during that term.
A technical renewal is not a new purchase of another year. It does not renew the domain registration either. Check the continuation terms before the paid service ends: an active ACME client does not replace payment or consent to another term. Individual certificate lifetimes depend on the issuer and product, so always check the actual expiry date.
For an active ACME subscription, Hostilla distinguishes the service term from the issued certificate's validity. Working HTTPS does not mean the next term is paid. Contact us before the service ends if you need an extension or a change to the covered domains.
Free SSL, AutoSSL and commercial ACME
Both free and paid certificates can use ACME. Let's Encrypt is one issuer that uses this protocol. A commercial certificate is not automatically cryptographically stronger simply because it is paid; validation, covered names, support and product terms also matter. See how Let's Encrypt works.
cPanel AutoSSL manages certificates for a hosting account; it is not another name for any ACME subscription. Review domains and validation results under cPanel → SSL/TLS Status. Do not remove a working certificate just to trigger automation. See SSL/TLS Status and AutoSSL documentation.
Commercial CaaS, or Certificate as a Service, links domain entitlements to a provider service. EAB may be needed to connect it. Sectigo describes CaaS separately from traditional manual certificate ordering.
Prepare your Hostilla deployment
- List every required name: the main domain, www, other subdomains or a wildcard. Confirm that the selected service covers them.
- Identify where the website is hosted and where DNS is managed. These can be different providers.
- For an active ACME service, check its details and term in the SSL section of the customer panel. Connection details belong to that particular service.
- Choose the client, validation method and installer. Your own server needs compatible software; arrange Hostilla-managed installation with support for the specific account.
- Verify HTTPS and the renewal schedule. Recheck automation after changing DNS, hosting or integration credentials.
EAB binds an ACME client account to entitlements at the provider. The EAB identifier, HMAC key and server URL are connection settings, not a Hostilla panel password. Protect the HMAC key and certificate private key; never publish them in website code or an unsecured request. See Sectigo client configuration.
What if a certificate does not renew?
Check the service end date, covered names, validation response, DNS integration permissions and renewal schedule. For HTTP-01, check whether the server address changed or the validation path is blocked. If issuance succeeded, inspect the installer and whether the correct service reloaded the new certificate.
Do not repeatedly force issuance without diagnosing the error. Find the failed step first. Scheduling and installation depend on the client; see Certbot renewal behaviour as one example. When contacting support, include the domain, expiry date, error time and message without secrets. Hostilla support can help with the next steps.
ACME questions
Do I have to generate a CSR manually?
You do not need to paste a CSR manually with a standard ACME client setup. The client still prepares a certificate request and uses a private key. ACME automates this step rather than removing it.
Will a purchased certificate appear on every website automatically?
No. A purchase or subscription activation does not replace client configuration, domain validation and installation. The installer must be configured for the particular server.
Does automatic renewal charge me for another year?
An ACME protocol renewal does not itself purchase another service term. Payments and subscription continuation follow the order terms. If unsure, confirm them with support before the paid term ends.
Does ACME support multiple names and wildcards?
It can support them when the issuer and product allow that scope. All names must be included in both the entitlements and the request, and control over them must be validated.