8

AUTOMATED CERTIFICATES

The Definitive Guide

8 chapters Last updated 21 September 2026 Free to read, no account

Automated certificate renewal works so well that it created a new problem: a process running somewhere, configured by somebody who has left, that nobody will notice has stopped until a certificate expires.

The documentation for these tools is excellent as reference and almost useless operationally, because it explains how to set one up and never how to find one somebody else set up.

This guide covers how ACME actually works, where renewals commonly run, how to find yours, and what breaks them.

In this guide you will learn:

  • What ACME does, in terms that survive a tool change
  • The difference between HTTP, DNS and TLS-ALPN validation
  • Where renewals commonly run, in order of likelihood
  • What a server migration does to an existing renewal
  • How to test a renewal without waiting ninety days
  • What to record so the next person can find it

Contents

1

What ACME actually does

Challenge, validation, issuance, in plain terms.

2

The three validation methods

HTTP, DNS and TLS-ALPN, and when each is the right one.

3

Where the renewal runs

Six common places, in order of how often it is each.

4

Finding one somebody else configured

The practical hunt, when nobody remembers.

5

What breaks renewals

Migrations, redirects, firewalls, and removed names.

6

Testing without waiting

Dry runs, staging endpoints, and rate limits.

7

Wildcards and DNS validation

Why wildcards force a different method.

8

Documenting it

The four facts that stop this recurring.

Chapter 1

What ACME actually does

Challenge, validation, issuance, in plain terms.

What ACME actually does

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 2

The three validation methods

HTTP, DNS and TLS-ALPN, and when each is the right one.

The three validation methods

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 3

Where the renewal runs

Six common places, in order of how often it is each.

Where the renewal runs

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 4

Finding one somebody else configured

The practical hunt, when nobody remembers.

Finding one somebody else configured

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 5

What breaks renewals

Migrations, redirects, firewalls, and removed names.

What breaks renewals

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 6

Testing without waiting

Dry runs, staging endpoints, and rate limits.

Testing without waiting

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 7

Wildcards and DNS validation

Why wildcards force a different method.

Wildcards and DNS validation

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Chapter 8

Documenting it

The four facts that stop this recurring.

Documenting it

This chapter is not written yet. Drop the prose into guide-bodies/<body>.html and rebuild.

Check yours

See where your own domain stands.

Everything in this guide, checked on your domain in about ten seconds. Free, no account, every finding shown in full.