Digital Certificate Automation with ACME

Overview

The University provides digital certificates to faculty and staff at no cost. See Request a Digital Certificate for more information. This article covers information for automating certificate renewal, where your server requests and renews its own certificates.

Automating Certificates with ACME

ACME (Automatic Certificate Management Environment) is a standard protocol that lets software on your server request, install, and renew certificates. Pitt Digital offers an ACME service through the University's certificate provider, CertiNext.

To get started, submit a request for Digital Certificates and include the host names you need certificates for.

  1. Let us know which domains you will be requesting certificates for.
  2. We will enable ACME services for you in CertiNext and send you an External Account Binding (EAB) key ID and key.
  3. You then set up your ACME software with the EAB key ID, the EAB key, and this directory URL: https://acme-us.certinext.io/v1/directory
  4. University domains are already validated with CertiNext, so your server does not need to answer a challenge on port 80 or publish a DNS-challenge record.
  5. Keep the EAB key private, since anyone who has it can request certificates for your domains.

Recommended Software

Any ACME client that supports External Account Binding should work with this service. You are welcome to use any software you wish; the tools below are examples.

  • Certbot (Linux). A free, open source ACME client from the Electronic Frontier Foundation. It runs from the command line and renews certificates on a schedule.
  • simple-acme (Windows). A free ACME client for Windows Server and IIS. It installs certificates into IIS and renews them through a scheduled task.

Pitt Digital does not provide assistance for these or any other certificate automation software. Please refer to each project's own documentation for help.

Load balancers: F5 and Azure Front Door

Your University website or service may be placed behind Pitt Digital's load balancer service (F5). Automatic certificate renewal is included as part of this service with no need to manage it yourself or set up ACME. The same is available for Azure services with Azure Front Door.

To ask about either option, submit a request for Digital Certificates.

Print Article