ACME (Automated Certificate Management Environment) is the protocol that lets a client request an SSL certificate, prove it controls the domain, and renew the certificate later without anyone opening a console. It matters more every year. The CA/Browser Forum has capped certificate lifetimes at 200 days since March 2026, dropping to 100 days in March 2027 and 47 days in March 2029. At 47 days, renewing by hand means roughly eight renewals a year for every certificate you own.
Most ACME material you will find assumes Let’s Encrypt. The clients are the same either way: certbot, acme.sh, win-acme and cert-manager all work against any ACME certificate authority. What differs is registration. Commercial CAs require External Account Binding (EAB), a key ID and HMAC key pair issued with your order that ties the ACME account to it. The tutorials below take that route, because it is the part that is documented least well elsewhere, and it is what you need with an ACME-enabled certificate from a commercial authority.
Pick the guide that matches what you are installing onto. Each one covers the whole path: registering the ACME account with EAB, issuing the certificate, putting it where the software expects it, and confirming that renewal runs on its own afterwards. If a client is already failing, go straight to the error guide at the end.
How to Install an ACME SSL Certificate on Apache & NGINX
Uses Certbot on both Debian-based and RHEL-based systems, with the Apache and NGINX plugins that edit the server configuration for you. Covers the packaging differences between distributions, the External Account Binding arguments a commercial CA needs, and the renewal timer, whose trigger changed in Certbot 4.0 from a fixed 30 days to one third of the certificate’s lifetime remaining.
How to Install an ACME SSL Certificate on LiteSpeed
Uses acme.sh with webroot validation, and covers both editions, OpenLiteSpeed and LiteSpeed Enterprise, whose document roots and reload commands are different. Includes the listener configuration in the WebAdmin console that makes the server actually serve the new certificate, and the reload hook that applies each renewal without dropping connections.
How to Install an ACME SSL Certificate on Windows IIS
Uses win-acme, driven from an elevated PowerShell window with the source, store, installation, ACME directory and EAB arguments on a single command. The certificate goes into the Windows certificate store, the HTTPS binding is created or updated in IIS, and a scheduled task handles renewal. Covers which build to download and where the per-endpoint configuration is kept.
How to Install an ACME SSL Certificate on cPanel
Uses acme.sh run as the cPanel account user, with webroot validation against the site’s document root and acme.sh’s built-in cPanel deploy hook, which calls the panel’s own UAPI to install the certificate on every domain on the account that the certificate covers. Written for accounts that have shell access, with a note on what to do when they do not.
How to Install an ACME SSL Certificate on Plesk
Uses Plesk’s own SSL It! and ACME SSL extensions, which support External Account Binding and handle validation, installation, assignment and renewal from inside the panel, with no scripting. The manual acme.sh route over SSH is covered afterwards, as the fallback for the cases the extensions do not reach.
How to Install an ACME SSL Certificate in Kubernetes
Uses cert-manager, installed with Helm from its OCI registry. Covers the ClusterIssuer with an External Account Binding section, the un-padded base64url encoding the EAB secret requires, the choice between annotating an Ingress and writing a Certificate resource (doing both duplicates the work rather than reinforcing it), and how cert-manager decides when to renew.
How to Install an ACME SSL Certificate on Mail Servers
Uses acme.sh with a DNS-01 challenge, because a mail server often serves no website for HTTP validation to use. Covers Postfix’s chain file parameter and the trap that comes with it, the TLS setting names Dovecot renamed in version 2.4, Exim, and the reload each daemon needs once a renewal has replaced the files.
How to Install an ACME SSL Certificate on Remote Desktop Protocol
Uses win-acme, which has no RDP installation plugin of its own. The route that works is its Script installation plugin pointed at ImportRDListener.ps1, a PowerShell script that ships with win-acme and writes the new certificate’s thumbprint to the RDP listener. Covers how to verify the listener picked it up.
How to Install an ACME SSL Certificate on pfSense
Uses the ACME package installed from pfSense’s Package Manager, working through its three tabs in order. Covers adding a commercial CA’s directory URL as a custom server, since the account form offers a dropdown rather than a URL box, and the collision between HTTP validation and the web interface’s own port 80 redirect.
How to Install an ACME SSL Certificate on OPNsense Firewall
Uses the official os-acme-client plugin, working through its four configuration pages in the order the plugin expects: an account with the custom CA URL and EAB credentials, a challenge type, an automation, and the certificate itself. The automation is what restarts the services using the certificate after each renewal, and skipping it is the usual reason a renewal appears not to take effect.
How to Install an ACME SSL Certificate on FortiGate
Uses FortiOS‘s own ACME support, so no external client is involved: an ACME listener bound to the internet-facing interface, then a certificate object using the acme2 enrolment protocol with your CA’s directory URL and EAB credentials. Covers the FortiOS version this requires, and the cases that still call for an external client, such as wildcards.
How to Install an ACME SSL Certificate on a Synology NAS
Uses acme.sh on a separate Linux host with a DNS challenge, since a NAS is usually behind NAT, then acme.sh’s built-in DSM deploy hook, which pushes each renewal into the NAS on its own. Covers the environment variable names the hook reads, which are case-sensitive and are not the ones older guides show.
How to Install an ACME SSL Certificate on TrueNAS
Uses acme.sh on a separate Linux host with a DNS-01 challenge and acme.sh’s built-in TrueNAS deploy hook, which imports the certificate and assigns it to the web interface at every renewal. Covers creating the API key the hook authenticates with, which TrueNAS release to target, and where TrueNAS CORE stands now.
How to Fix ACME SSL Certificate Errors
The troubleshooting guide for when a client fails. ACME errors are not client-specific: every client reports the machine-readable error types defined in RFC 8555, and the type tells you which leg broke, whether that is your client talking to the CA, the CA trying to reach or resolve you, a policy decision about the name itself, or something transient worth retrying. Covers each common type with its real cause and its fix.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
