Quick answer
ACME automation uses a standard protocol to request, validate, issue, and renew TLS certificates without manual CA workflows. In production infrastructure, the important follow-up is delivery: the renewed certificate must reach HAProxy, IIS, Kubernetes, or another serving layer and then be verified from the live endpoint.
Questions this hub answers
how does ACME certificate automation work
how to automate HAProxy certificate renewal
how to issue an IIS certificate with win-acme
how to use certbot with trust.certlocker.io
what happens after an ACME certificate is issued
how do I verify ACME renewal worked
What this topic covers
ACME solves a large part of certificate issuance, but operational teams still need CA account handling, DNS validation, renewal windows, deployment hooks, private key handling, and audit evidence around who changed what.
Where CertLocker fits
CertLocker exposes ACME workflows alongside certificate inventory, token-scoped delivery, endpoint probes, and audit events. That lets teams see whether a renewal merely completed or actually reached the production listener. ACME profiles keep classical, short-lived, and future MTC/PQC shapes selectable at order time.
Start with these pages
ACME Certificate Automation for HAProxy Nginx IIS
A guide for moving from Certbot plus cron scripts to a TLS workflow with inventory, scoped delivery, endpoint verification, and audit.
Why Renewal Scripts Break TLS Automation in 2026
Renewal scripts are useful until they become the undocumented control plane for TLS. Here is where they break and how to move beyond them.
ACME Profiles: Choosing the Right Certificate Shape Before Renewal Starts
How directory profiles become operational in CertLocker.
Conquering the Last Mile
Watch certificate issuance, SSH/SFTP deployment and Windows IIS, without a CertLocker target agent.
Post-Quantum Cryptography: What Changes for Certificate Operations
PQ-ready profiles, dual orders, and PQC-aware probes.
ACME End-to-End
Walkthrough of ACME state, DNS automation, inventory, and tokens.
ACME Renewal in CertLocker
What should happen after the certificate is issued.
HAProxy 3.3 Native ACME with CertLocker
Field notes on native HAProxy ACME integration.
How to Issue an IIS Certificate with CertLocker ACME and win-acme
Windows IIS issuance and renewal with win-acme.
Certbot with trust.certlocker.io
Stock Certbot CSR delivery from Trust — workflows, tokens, host timers.
Certificate delivery
Scoped delivery tokens for moving issued certificates into services.
Certificate lifecycle management
ACME workflows connected to ownership and expiry state.
Integrations through Automations
Attach service installation and activation steps to issuance and renewal.
CertLocker vs Certbot
ACME client automation compared with lifecycle operations.
CertLocker vs AWS ACM
Managed cloud certificates compared with mixed infrastructure needs.
Frequently asked questions
Does ACME automation remove the need for certificate monitoring?
No. ACME can renew a certificate successfully while the live service continues serving an old or incomplete chain. Monitoring should probe the actual endpoint after renewal and delivery.
What should teams verify after ACME renewal?
Teams should verify the certificate file, private key match, served chain, hostname, expiry, service reload, and audit trail. The useful signal is what clients see on the endpoint, not just the ACME order state.
Evaluate this against your environment
Bring your current inventory or operational problem to a hosted walkthrough. We will help map your hosts, certificates, access paths and audit needs.