Automating TLS Certificate Issuance and Renewal with ACME


Introduction

How do I automatically request and renew a Virginia Tech SSL/TLS certificate using ACME?                                                                                                               

 

Instructions

VT Certificate Manager supports the ACME protocol (RFC 8555), allowing tools like certbot, acme.sh, and win-acme to issue and renew TLS certificates automatically without manual intervention.

Before you begin

  • Port 80 must be reachable from the Certificate Manager server for HTTP-01 challenge validation. If port 80 is firewalled, use TLS-ALPN-01 or DNS-01 instead.
  • Wildcard certificates (e.g., *.dept.vt.edu) require DNS-01 — HTTP-01 cannot validate wildcards.
  • Validation is skipped if NL entitles you for that domain.

To enroll for an automated certificate:                                                                                                                                                                          
                                                                                                                                                                                                                   

  1. Log in to the Certificate Manager and navigate to the Automated Certificates page.
  2. Generate an External Account Binding (EAB) credential pair (Key ID and HMAC key). These credentials are single-use for account registration — once your ACME client registers, that account can request certificates for any number of domains. Generate a new set only if you need a separate ACME account (e.g., a different server or cluster).
  3. Install an ACME client on your server (certbot, acme.sh, or win-acme are supported). 
  4. Register your ACME account and issue a certificate. When prompted for a directory URL, enter: https://certs.it.vt.edu/acme/directory 
  5. See the VT ACME Guide for complete commands covering NGINX, Apache, standalone, DNS-01, Docker, and Kubernetes deployments.
  6. Verify automatic renewal is working by running certbot renew --dry-run after initial setup

For issues or questions, contact VT 4Help.