Free TLS certificates and ACME

What ACME actually does #

Every free publicly trusted certificate comes out of the same protocol. ACME — Automatic Certificate Management Environment, RFC 8555 — replaces the old cycle of generating a request, pasting it into a web form, waiting for an email and downloading a zip file. A client running on your server does all of it:

1. Registers an account key with the CA.
2. Asks for a certificate covering a list of names.
3. Receives a challenge for each name — something only whoever controls that name can do.
4. Completes the challenges, sends a CSR, and receives the certificate.

The CSR has not gone away; you just never see it. The client generates the key and the request locally, exactly as openssl req would, and the private key never leaves the machine. What ACME removes is the person in the middle.

That is also what makes free issuance possible. A CA that never has to pay anyone to read an email can afford to charge nothing — and in exchange it issues certificates with short lifetimes, which is the trade the whole model rests on.

Which CAs issue free certificates #

All of them are domain validation only, all of them are in the same root stores, and all of them speak the same protocol — so the choice is close to reversible. Pointing a client at a different ACME directory URL is a one-line change. Choose on operational grounds: rate limits, who you already have an account with, whether you want a UI. Certificate quality is not a differentiator, because there is no difference to find.

The challenge type decides what you can get #

Two challenges matter in practice, and the one you are able to complete decides what the CA is willing to issue.

certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

certbot certonly --dns-cloudflare -d example.com -d '*.example.com'

Neither block is marked for verification. Both need a public hostname and a live CA, and the test harness runs with no network by design, so these are reviewed by hand instead.

What free will not give you #

• Organisation or extended validation. Free issuance proves control of a name and nothing else. If you need a certificate that says a company exists, you are buying it.
• Client certificates. ACME issues serverAuth certificates. Anything for mTLS comes from a CA you run — see create a client certificate.
• Names that do not resolve publicly. .local, .internal, bare hostnames and private IP ranges cannot pass any challenge, because no public CA is able to validate them. This is the case people try hardest to solve with a self-signed certificate, and it is the case a private CA exists for.
• Long lifetimes. Short validity is deliberate, not a limitation of the free tier. Something in your stack that cannot renew unattended is a problem to fix rather than to buy your way around.

Renewal is the whole point #

The certificate is not the deliverable — unattended renewal is. Issuance happens once and renewal happens for as long as the service exists, so the only question worth asking of a setup is what it does when nobody is watching it.

openssl x509 -in certificate.crt -noout -checkend 2592000

Certificate will not expire

That is thirty days in seconds; a non-zero exit means the certificate expires inside the window. Alert on it even when renewal is fully automated, because the failure that actually hurts is the renewal that quietly stopped working — and until the day it matters, that looks exactly like one that is still running.

More at check certificate expiry and fixing “certificate has expired”.