---
title: "ACME"
description: "2 posts about ACME, summarised, each linking to the original."
---

# ACME
> 2 posts about ACME, summarised, each linking to the original.

## Articles

### [Building a certificate authority for the whole Internet](https://yomu.fyi/post/building-a-certificate-authority-for-the-whole-internet.md)
- Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md)
- Author: Steve Goldsmith
- Published: Sep 29, 2026
- Type: Announcement

Cloudflare, which terminates TLS for millions of domains and sits in front of over 20% of global Internet request traffic, announced its intent to become a public certificate authority (CA) during Birthday Week 2026. The company has applied for inclusion in the Chrome, Apple, Microsoft, and Mozilla root programs and signed a definitive agreement to acquire an established root from GlobalSign. This acquisition ensures certificate compatibility with older clients that a fresh root would never reach, addressing the long tail of devices where avoidable breakage occurs. Cloudflare plans to be among the first CAs to issue production Merkle Tree Certificates (MTCs) in early 2027, targeting post-quantum readiness as part of Chrome’s Quantum-resistant Root Program. The CA will be ACME-first, require ACME Renewal Information (ARI) support for issuance, and operate transparently with reproducible builds of signing software and a public dashboard.


### [How CDNs Generate Certificates](https://yomu.fyi/post/how-cdns-generate-certificates.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Jun 25, 2020
- Type: Explainer

Fly describes how its CDN automatically generates TLS certificates for customer hostnames with Let’s Encrypt and ACME, focusing on why the older tls-sni-01 validation method was unsafe on shared hosting. ACME authenticates an account with an ECDSA/EdDSA key, creates an order, and verifies domain control through challenges; Fly uses tls-alpn-01, which avoids requiring DNS access or port 80. For validation, Fly requests a challenge, creates a self-signed certificate containing Let’s Encrypt’s token, stores it in distributed certificate storage, and signals the CA to connect with a ClientHello selecting acme-tls/1 via ALPN. The Rust proxy recognizes that ALPN case, retrieves the challenge certificate, and serves it to Let’s Encrypt, which completes the challenge and permits certificate issuance. Fly assigns each application a unique routable IPv6 address and requires CNAME resolution to it for ALPN validation; wildcard certificates instead use DNS challenges.