<aside> 🧭

Module 10 · ACME & Let's Encrypt: Automation Is Now Mandatory

Module 09 ended with the industry's real answer to revocation: make certificates expire before it matters. This module is how you survive that. 47-day certificates are only possible if issuance is completely automatic — and ACME is the protocol that made it automatic.

🧠 concept → 🧪 exercise → ✅ expected result (hidden) → 🎯 interview questions (answers hidden)

Prerequisite: Modules 01–09. You need CSRs from Module 04, the deploy-and-reload lesson from Module 08 (B3), and the short-lifetime argument from Module 09 (C3).

</aside>

<aside> 🏧

The picture to hold in your head for this whole module — the passport kiosk.

The old way of getting a certificate: fill in a form, email it to a company, wait, pay, receive a file, install it by hand. Repeat every year. That is a human process, and humans forget.

ACME replaces the counter clerk with a self-service kiosk. You walk up, the machine asks you to prove you live at the address, you do, and it prints the document. No appointment, no human, thirty seconds.

Three things follow immediately, and they are the shape of this whole module:

1. The machine must be able to check your claim without a human — that is the challenge.
2. It needs to know who is asking — that is the account key.
3. It must stop one person printing a million passports — those are the rate limits. </aside>

<aside> 🖥️

About the exercises in this module. Several of them talk to Let's Encrypt's live API, which is read-only and safe — fetching the directory costs nothing and is not rate-limited.

Anything that would actually issue a certificate uses the staging environment, which issues untrusted certificates and has far looser limits. Never test against production. That is the single most common way people get themselves rate-limited for a week.

Nothing in this module needs root, and nothing touches your system trust store.

</aside>

Part A · What ACME actually is

A1 · The directory — the menu board at the kiosk

<aside> 📖

Official docs: RFC 8555 — Automatic Certificate Management Environment · Let's Encrypt — ACME endpoints · curl manual

</aside>

<aside> 📋

The analogy — the menu board above the kiosk.

You do not walk up and start pressing buttons. You read the board first: new applications — slot 3. Renewals — slot 5. Cancellations — slot 7.

And crucially: the board can change. The kiosk operator can move things around, and a customer who memorised "slot 3" last year will press the wrong button.

That board is the ACME directory — a single JSON document listing every URL the client needs. A well-written client fetches it every time and never hard-codes a URL.

</aside>

🧪 Exercise A1.1 — Read the live directory from the world's largest CA

curl -sS <https://acme-v02.api.letsencrypt.org/directory> | python3 -m json.tool

• ✅ Expected result — click to reveal

🧪 Exercise A1.2 — Compare production with staging

echo "=== PRODUCTION ==="
curl -sS <https://acme-v02.api.letsencrypt.org/directory> | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['newOrder'])"

echo "=== STAGING - use this for ALL testing ==="
curl -sS <https://acme-staging-v02.api.letsencrypt.org/directory> | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['newOrder'])"

• ✅ Expected result — click to reveal

🎯 Interview questions — The ACME directory

• Q. What is ACME and what problem does it solve?

A2 · The account key — and what it does NOT authorise