How do I automatically request and renew a Virginia Tech SSL/TLS certificate using ACME?                                                                                                               

VT Certificate Manager supports the ACME protocol (RFC 8555), allowing tools like certbot and acme.sh to issue and renew TLS certificates automatically without manual intervention.                   

Before you begin:                                                                                                                                                                                      

• Port 80 must be reachable from the Certificate Manager server for HTTP-01 challenge validation. If port 80 is firewalled, use DNS-01 instead.                                                                                                                     
• Wildcard certificates (e.g., *.dept.vt.edu) require DNS-01 — HTTP-01 cannot validate wildcards.
• Validation is skipped if NL entitles you for that domain.                                                                                                      

To enroll for an automated certificate:                                                                                                                                                                                                                                                                                                                                                           

1. Log in to the Certificate Manager and navigate to the Automated Certificates page.                                                                                                                  
2. Generate an External Account Binding (EAB) credential pair (Key ID and HMAC key). These credentials are single-use for account registration — once your ACME client registers, that account can request certificates for any number of domains. Generate a new set only if you need a separate ACME account (e.g., a different server or cluster).                                                     
3. Install an ACME client on your server (certbot or acme.sh are supported).                                                                                                                           
4. Register your ACME account and issue a certificate using the VT ACME  directory URL and your EAB credentials. See the [VT ACME Guide] for complete commands covering NGINX, Apache, standalone, DNS-01, Docker, and Kubernetes deployments.                                                                                                                                                
5. Verify automatic renewal is working by running certbot renew --dry-run after initial setup.                                                                                                                                                                                                            

 For issues or questions, contact VT 4Help.