> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# ACME enrollment

> Issue certificates using the ACME protocol with Certbot, cert-manager, and other ACME clients.

> [!TIP]
>
> New to Infisical Certificate Management? Start with [Issue Your First Certificate](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md).

Use the ACME enrollment method to request and renew certificates automatically using standard ACME clients. Infisical acts as an ACME server, compatible with tools like Certbot, cert-manager, and any [RFC 8555](https://datatracker.ietf.org/doc/html/rfc8555/)-compliant client.

> [!NOTE]
>
> ACME enrollment is configured on profiles attached to your [Application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md). Product Admins attach [profiles](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md), and Application Admins configure enrollment methods on those profiles.

## When to use ACME enrollment

> [card] Web Servers
>
> NGINX, Apache, Tomcat, and other web servers with Certbot.

> [card] Kubernetes
>
> Use cert-manager to issue certificates for workloads.

> [card] Load Balancers
>
> Automate certificate provisioning for HAProxy, Traefik, and others.

> [card] Automated Renewal
>
> Let ACME clients handle renewal automatically before expiration.

## Guides

> [card] [Kubernetes (cert-manager)](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme.md)
>
> Provision TLS certificates in Kubernetes with cert-manager's ACME issuer.

> [card] [NGINX](https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot.md)
>
> Issue TLS certificates for NGINX with Certbot.

> [card] [Apache](https://infisical.com/docs/documentation/platform/pki/guides/applications/apache-certbot.md)
>
> Issue TLS certificates for Apache HTTP Server with Certbot.

> [card] [Tomcat](https://infisical.com/docs/documentation/platform/pki/guides/applications/tomcat-certbot.md)
>
> Issue TLS certificates for Apache Tomcat with Certbot.

> [card] [JBoss/WildFly](https://infisical.com/docs/documentation/platform/pki/guides/applications/jboss-certbot.md)
>
> Issue TLS certificates for JBoss or WildFly with Certbot.

> [card] [Windows Server](https://infisical.com/docs/documentation/platform/pki/guides/applications/windows-server-acme.md)
>
> Issue TLS certificates for Windows Server with win-acme.

> [card] [Gloo Mesh](https://infisical.com/docs/documentation/platform/pki/guides/applications/gloo-mesh.md)
>
> Provision Istio intermediate CA certificates for Gloo Mesh.

## Prerequisites

Install an [ACME client](https://letsencrypt.org/docs/client-options/) on your server. The client handles domain validation challenges and certificate renewal.

## Configure ACME enrollment

**1. Navigate to your Application**

Go to **Certificate Manager → Applications** and select your Application.

**2. Configure enrollment on an attached profile**

Go to the **Settings** tab and find the **Certificate Profiles** section. Select **Configure** on the profile you want to enable ACME enrollment for.

> [!NOTE]
>
> Profiles are attached by Product Admins. If you don't see any profiles, ask your Product Admin to attach one.

**3. Add ACME enrollment**

In the modal, select **Add enrollment method** and select **ACME**.

**4. Configure domain validation**

By default, Infisical verifies domain ownership using the [HTTP-01 challenge](https://letsencrypt.org/docs/challenge-types/#http-01-challenge).

| Option | Description |
| - | - |
| **HTTP-01 Challenge** | ACME client proves domain ownership by serving a file at `/.well-known/acme-challenge/` |
| **Skip Validation** | Disable domain ownership validation (use for internal domains) |

> [!WARNING]
>
> Only skip validation for internal domains where you trust all certificate requesters. For public-facing services, always use domain validation.

> [!NOTE]
>
> Skipping validation here is different from [External ACME CA integrations](https://infisical.com/docs/documentation/platform/pki/ca/acme-ca.md). When using an external ACME CA (like Let's Encrypt), Infisical must always complete DNS-01 challenges with the upstream CA.

**5. Get ACME credentials**

After saving, select **Reveal ACME EAB** to get the credentials your ACME client needs:

| Credential | Purpose |
| - | - |
| **ACME Directory URL** | The server URL your ACME client connects to |
| **EAB Key Identifier (KID)** | Identifies your ACME account |
| **EAB Secret** | Authenticates your ACME client |

> [!NOTE]
>
> The ACME Directory URL is unique to this Application + Profile pair. Certificates requested through this URL are associated with this Application and follow the selected profile's policy.

## Issue a certificate

Configure your ACME client with the credentials from the previous step.

> [tab] Certbot
>
> Request a certificate using Certbot's standalone mode:
>
> ```bash theme={"dark"}
> sudo certbot certonly \
>   --standalone \
>   --server "<ACME Directory URL>" \
>   --eab-kid "<EAB Key Identifier>" \
>   --eab-hmac-key "<EAB Secret>" \
>   -d api.example.com \
>   --email admin@example.com \
>   --agree-tos \
>   --non-interactive
> ```
>
> Certbot stores certificates in `/etc/letsencrypt/live/api.example.com/`:
>
> * `fullchain.pem` — Certificate + chain
> * `privkey.pem` — Private key
> * `cert.pem` — Certificate only
> * `chain.pem` — CA chain only
>
> For web server integration, see the guides:
>
> * [NGINX with Certbot](https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot.md)
> * [Apache with Certbot](https://infisical.com/docs/documentation/platform/pki/guides/applications/apache-certbot.md)
> * [Tomcat with Certbot](https://infisical.com/docs/documentation/platform/pki/guides/applications/tomcat-certbot.md)

> [tab] cert-manager (Kubernetes)
>
> Create an ACME ClusterIssuer for cert-manager:
>
> ```yaml theme={"dark"}
> apiVersion: cert-manager.io/v1
> kind: ClusterIssuer
> metadata:
>   name: infisical-acme
> spec:
>   acme:
>     server: "<ACME Directory URL>"
>     email: admin@example.com
>     privateKeySecretRef:
>       name: infisical-acme-account
>     externalAccountBinding:
>       keyID: "<EAB Key Identifier>"
>       keySecretRef:
>         name: infisical-eab-secret
>         key: secret
>       keyAlgorithm: HS256
>     solvers:
>       - http01:
>           ingress:
>             class: nginx
> ```
>
> Create the EAB secret:
>
> ```bash theme={"dark"}
> kubectl create secret generic infisical-eab-secret \
>   --from-literal=secret="<EAB Secret>"
> ```
>
> For full setup, see [Kubernetes cert-manager guide](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme.md).

> [tab] Other Clients
>
> Any [RFC 8555-compliant ACME client](https://letsencrypt.org/docs/client-options/) works with Infisical. Configure your client with:
>
> 1. **Server/Directory URL**: Your ACME Directory URL
> 2. **External Account Binding (EAB)**: Use the KID and Secret
> 3. **Challenge Type**: HTTP-01 (or skip if configured)
>
> Refer to your client's documentation for specific configuration.

## Automatic renewal

ACME clients handle renewal automatically. Most clients (like Certbot) install a cron job or systemd timer that checks for expiring certificates and renews them.

```bash theme={"dark"}
# Test renewal (dry run)
sudo certbot renew --dry-run

# Force renewal
sudo certbot renew --force-renewal
```

For Kubernetes, cert-manager monitors Certificate resources and renews them automatically before expiration.

## What's next?

> [card] [NGINX Guide](https://infisical.com/docs/documentation/platform/pki/guides/applications/nginx-certbot.md)
>
> Set up HTTPS on NGINX with Certbot.

> [card] [Kubernetes Guide](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-acme.md)
>
> Issue certificates for Kubernetes workloads.

> [card] [Certificate Syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)
>
> Push certificates to cloud destinations.

> [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)
>
> Get notified when certificates are about to expire.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.