How to Set Up Automatic SSL Certificate Renewal with ACME: cPanel, Apache, Nginx, and Kubernetes

The SSL industry has been changing for a while and is set to continue. Chief among the changes is the ever-shortening SSL lifetime limit. For most website owners, this is going to make SSL management much more difficult. But with automatic SSL renewal, it doesn’t have to be. 

Why automatic SSL renewal matters

If you implement automatic SSL renewal, you get the peace of mind of knowing your website or service won’t be taken offline should you forget your SSL’s expiration date. This ensures users can always visit your site and won’t lose trust in you if your site is flagged as “not secure”. It’s especially helpful if you have multiple certificates to keep track of. 

But another key reason is shortening SSL lifetimes. This has been happening for years now, going from 3 years in 2016, reducing to 200 days in 2026, and will go down to just 47 days in 2029. This is due to the CA/Browser Forum’s belief that shorter lifetimes mean a much more secure SSL ecosystem. 

Needing to renew an SSL every 47 days will mean more complex SSL management for everyone, particularly if you’re juggling multiple certificates. That’s where SSL automation comes in. 

Specifically, Automated Certificate Management Environment (ACME). It’s an open communication standard prominently used across the SSL industry that automates every aspect of SSL issuance and renewal, from validation to installation.

What you need to set up ACME automation

To use ACME, you’ll need the following:

• Server access – You need to be able to install software/configure the server where the SSL lives. Some shared hosting setups may not let you do that, though some plans have ACME included.
• A certificate authority (CA) that supports ACME – Not every CA works with ACME. This goes for certificate types too, which we’ll address more later. 
• An ACME-compatible environment – Not all servers automatically support ACME, so you may need to do some tweaking or manually install an ACME client like Certbot, AutoSSL, or cert-manager.  

How ACME renewal works

Once you have ACME set up, it will renew and reinstall your SSL in the background without you having to do a thing. It can be broken down into the following steps:

• Your ACME client requests a new certificate from the CA. Depending on the ACME client, this usually happens when the current SSL has a third of its lifetime left.
• The client then needs to prove you own the domain via a validation challenge. This can include having your server place a specific file at a designated URL, or adding a specific DNS record that only someone with access to the domain could set up. Then the CA checks for it, and if it’s there, approves validation.
• The CA issues the certificate, and the client replaces the old SSL with the new one.
• This process repeats once the current SSL is due to expire.

This is the general process for domain-validated (DV) SSLs. This process works almost the same way for organization validation (OV) and extended validation (EV) certificates when it comes to domain validation and reissuance. Where it differs is business validation, which must always be done manually. Fortunately, it only needs to be performed every 397 days. So OV and EV renewals can be automated during that time, until it’s time to verify your business, just once per year. However, it’s worth bearing in mind that not every CA supports ACME for OV and EV SSLs just yet.

ACME works much the same way, no matter what your server type, but setting up is a little different each time. Find the walkthroughs for the four most common environments – cPanel, Apache, Nginx, and Kubernetes – below.

Option 1 – cPanel

cPanel has a built-in feature called AutoSSL that uses ACME to automate SSL renewal. Set it up by:

• Log in to cPanel and under SSL/TLS Status, you can see whether your domains already have an AutoSSL-managed certificate. Many hosts have this turned on by default.
• If it’s not already running, select your domains and click Run AutoSSL to trigger issuance right away.

After setting up, you can return to the SSL/TLS Status page periodically to check if a certificate is active, when it expires, and whether AutoSSL is managing it.

Option 2 – Apache

Setting up ACME on Apache is a little more complex than AutoSSL, requiring actual server access (SSH), installing software, and running commands. For Apache, the most common ACME client is Certbot, which is maintained by the Electronic Frontier Foundation.

1. Install Certbot

Find instructions on Certbot’s site, specific to your particular OS.

2. Get your certificate

Get Certbot to request the certificate, complete domain validation, install it, and update your Apache configuration to use HTTPS, all in one step. Run the command:

sudo certbot –apache

You’ll be prompted to share an email (for renewal notifications) and which domains to secure.

3. Confirm auto-renewal is set up

Most Certbot installations automatically check for renewals twice a day. Confirm it’s working with a dry run, which simulates the renewal process without actually changing your certificate. Run:

sudo certbot renew –dry-run

If that completes without errors, you don’t need to do anything else.

Option 3 — Nginx

Nginx also uses Certbot, just with a different plugin and a slightly different flow than Apache, since Nginx handles its configuration files differently.

1. Install Certbot

Run the command from Certbot’s instructions page, selecting Nginx and your operating system.

2. Get your certificate

Run this command, and Certbot will request the certificate, complete domain validation, install it, and update your Nginx configuration to serve HTTPS:

sudo certbot –nginx

You’ll be prompted for an email address and which domains to secure.

3. Confirm auto-renewal is working

Check things are working as they should with a dry run, which simulates the process without changing your current certificate:

sudo certbot renew –dry-run

If it succeeds, your renewals will keep happening on their own from here.

Option 4 – Kubernetes

On Kubernetes, the standard tool is cert-manager, an add-on that’s the equivalent of what Certbot does for Apache or Nginx.

Setup generally involves installing cert-manager into your cluster, then configuring an Issuer or ClusterIssuer, which tells it which CA to use and how to validate domains via ACME. Then you need to request a Certificate resource for your domain, and cert-manager handles requesting, validating, installing, and renewing it automatically from there. 

Check out cert-manager’s own documentation for the exact installation and configuration steps for your specific cluster setup.

How to verify automatic renewals

The best way to make sure automation is working is to test it before you need it. Most ACME clients support a dry run mode that walks through the full renewal process without removing or replacing your current SSL certificate.  After a real renewal, be sure to check the certificate’s new expiration date to confirm it is updated, and keep an eye on your ACME client’s logs over time to make sure renewals continue succeeding.

Common ACME problems

Some recurring issues that can trip people up include: 

• DNS validation failures due to missing DNS records, a lack of propagated Firewall, or port restrictions blocking validation requests 
• Expired or revoked API credentials for DNS-based validation 
• Incorrect file or folder permissions preventing the client from writing validation files
• Successful renewals that don’t get deployed to the server.

Fortunately, fixing these problems isn’t overly complicated. 

H3: Quick checklist for fixing common ACME problems

• Confirm DNS records are correct and fully propagated before validation
• Make sure ports 80/443 (or your validation method’s required port) aren’t blocked by a firewall
• Keep API credentials for DNS validation current and unexpired
• Check file/folder permissions if validation keeps failing
• Confirm renewed certificates are actually being installed

The takeaway

SSL lifetimes may be shortening, but that doesn’t mean SSL management needs to increase in complexity. Automation has been around for a while, and it’s bound to be increasingly adopted over the next few years. Don’t get left behind. By implementing it early, you or your organization will spend less time on managing certificates and reduce your outage risk by the time SSL lifetimes are reduced to 47 days. 

Frequently asked questions

Which ACME client should I use?

This depends entirely on your server environment and what client it supports. Certbot is the most common choice for Apache and Nginx servers, cPanel typically uses its built-in AutoSSL rather than a separate client, and Kubernetes uses cert-manager.

Can commercial SSL certificates use ACME?

Yes, many commercial certificate authorities, such as SSL.com, now support ACME alongside free options like Let’s Encrypt. 

Does ACME renew certificates automatically?

Yes. Once set up, an ACME client checks in periodically and renews the certificate before it expires, no manual input required.

Can I automate OV or EV certificates?

This depends on the CA and client. Some only support DV certificates by default. For those that do support OV and EV SSL, it comes with caveats. ACME can automate the domain validation and issuance parts of the process, but OV and EV certificates also require verifying the business itself, which generally involves manual steps that can’t be fully automated.

How often should I test renewals?

Many teams perform a dry run of the renewal process every few months, or whenever the server, DNS setup, or ACME client configuration changes.