Loading…
Topic
2 posts about ACME. Every summary links to the original.
See the idea
ACME uses different domain-control validation methods. tls-alpn-01 works on shared hosting without DNS access; DNS challenges suit wildcard certificates but require external DNS control.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.
Fly describes how its CDN automatically generates TLS certificates for customer hostnames with Let’s Encrypt and ACME, focusing on why the older tls-sni-01 validation method was unsafe on shared hosting. ACME authenticates an account with an ECDSA/EdDSA key, creates an order, and verifies domain control through challenges; Fly uses tls-alpn-01, which avoids requiring DNS access or port 80. For validation, Fly requests a challenge, creates a self-signed certificate containing Let’s Encrypt’s token, stores it in distributed certificate storage, and signals the CA to connect with a ClientHello selecting acme-tls/1 via ALPN. The Rust proxy recognizes that ALPN case, retrieves the challenge certificate, and serves it to Let’s Encrypt, which completes the challenge and permits certificate issuance. Fly assigns each application a unique routable IPv6 address and requires CNAME resolution to it for ALPN validation; wildcard certificates instead use DNS challenges.
The best engineering reads, once a week.
