Skip to main content
  • IETF 117 Highlights

    IETF 117 is a few weeks behind us and Dhruv Dhody, IAB Member and liaison to the IESG, took the opportunity to report on a few highlights and some impressions.

    • Dhruv DhodyIAB Member and liaison to the IESG
    21 Aug 2023
  • Proposed response to meeting venue consultations and the complex issues raised

    The IETF Administration LLC recently sought feedback from the community on the possibility of holding an IETF Meeting in the cities of Beijing, Istanbul, Kuala Lumpur and Shenzhen, with received feedback including views that were well expressed and well argued but strongly conflicting. The IETF LLC has considered this feedback in-depth and now seeks community feedback on its proposed response.

    • Jay DaleyIETF Executive Director
    21 Aug 2023
  • Submit Birds of a Feather session proposals for IETF 118

    Now's the time to submit Birds of a Feather session (BOFs) ideas for the IETF 118 meeting 4-10 November 2023, with proposals due by 8 September.

      16 Aug 2023
    • Applied Networking Research Workshop 2023 Review

      More than 250 participants gathered online and in person for ANRW 2023, the academic workshop that provides a forum for researchers, vendors, network operators, and the Internet standards community to present and discuss emerging results in applied networking research.

      • Maria ApostolakiANRW Program co-chair
      • Francis YanANRW Program co-chair
      16 Aug 2023
    • IETF 117 post-meeting survey

      IETF 117 San Francisco was held 22-28 July 2023 and the results of the post-meeting survey are now available on a web-based interactive dashboard.

      • Jay DaleyIETF Executive Director
      11 Aug 2023

    Filter by topic and date

    Filter by topic and date

    ACME: Universal Encryption through Automation

    • Richard Barnes
    • Jacob Hoffman-Andrews
    • Daniel McCarney

    12 Mar 2019

    The Automated Certificate Management Environment (ACME) protocol, recently published as RFC 8555, lets you set up a secure website in just a few seconds.

    ACME Badge Horizontal

    When you connect to your bank or your health care provider over the Internet, you need to know that you’re actually talking to them, and not a bad actor who is impersonating them and might steal your information or tamper with the transaction. Security protocols such as TLS 1.3 provide encryption that protects you from everyone except the other side of the connection, but don’t themselves allow you to verify who that person is. 

    To verify that the other side of the connection is who you think it is, we typically rely on a “public key infrastructure” (PKI). Using PKI technologies, the entities you interact with on the Internet get digital “certificates” from Certificate Authorities (CAs). These certificates let them prove their identity to you when you connect to them.

    browser address bar
    The green lock indicates that website has a certificate for “www.ietf.org”

    For a long time, though, the need for digital certificates made it harder for people to deploy TLS. This is because getting a certificate for a web server has always been a very manual process—the owner of the web server in question had to go to a CA’s web site, enter a bunch of information, take some steps to prove they control the domain name, wait for the certificate to be issued, and then finally download their certificate and install it on the web server. It was a complex and error-prone process that cost lots of valuable time for system administrators.

    The ACME protocol, recently published as RFC 8555, changes all that. With ACME, you can set up a secure website automatically, in just a few seconds.

    ACME takes all those steps that an administrator has to do and makes them automatic. Instead of filling information into a form on the web and following written instructions, the server that needs a certificate can send in its information in a standard form, and get instructions that it can read and follow automatically. In many cases, this allows a server to get a certificate more or less instantly and with no human intervention at all, so that security can be on by default.

    Back in 2015, Let’s Encrypt created a new Certificate Authority using an early draft of ACME, which let people start experimenting with the protocol. Through the IETF’s open process, ACME was updated to incorporate feedback from other CAs and users of certificates, and today several CAs have ACME interfaces either in production or in development, including BuyPass, Entrust, DigiCert, and Sectigo. Together, these CAs account for the majority of the certificates used on the Internet; Let’s Encrypt alone uses ACME to issue more than a million certificates per day.

    Webpages using HTTPS over time
    Web pages using HTTPS over time (image courtesy Let's Encrypt)

    The automation enabled by ACME unlocks the potential for universal encryption on the Internet.  When Let’s Encrypt launched in 2014, less than 30% of web requests were encrypted with HTTPS. Today, that number is nearly 80%.  The publication of ACME as an IETF RFC and its adoption by more and more CAs will help bring us closer to closer to ensuring all communications on the Internet are confidential and authentic.


    Share this page