| 1 | --- |
| 2 | title: ACME |
| 3 | description: Manage TLS certificates independently of your hosting provider, at deploy time or from an application. |
| 4 | --- |
| 5 | |
| 6 | ACME (Automatic Certificate Management Environment) is the protocol used by |
| 7 | certificate authorities such as Let's Encrypt and ZeroSSL to issue TLS |
| 8 | certificates. Alchemy manages the account and certificate separately from the |
| 9 | service that terminates TLS. You can issue a certificate once and pass its PEM |
| 10 | chain and private key to Fly or another consumer. |
| 11 | |
| 12 | ## Choose when to issue |
| 13 | |
| 14 | | | During deployment | From an application | |
| 15 | | --- | --- | --- | |
| 16 | | API | `ACME.Certificate` | `ACME.IssueCertificate` | |
| 17 | | Account | `ACME.Account` | Bind an existing `ACME.Account` | |
| 18 | | DNS-01 validation | Serializable solver descriptor | Runtime DNS client wrapped as a solver | |
| 19 | | Certificate storage | Stack state | Your application's responsibility | |
| 20 | | Renewal | Evaluated on each deployment | Your application's scheduler | |
| 21 | | Revocation | Optional on resource deletion | Explicit `revoke` call | |
| 22 | |
| 23 | Start with a deploy-time certificate unless your application needs to issue |
| 24 | certificates without redeploying. Both paths support wildcard names and use |
| 25 | DNS-01 validation; HTTP-01 and TLS-ALPN-01 are not implemented. |
| 26 | |
| 27 | ## Guides |
| 28 | |
| 29 | - [Getting started](/acme/getting-started) — deploy a Let's Encrypt staging |
| 30 | certificate using an existing Cloudflare zone. |
| 31 | - [Certificate authorities](/acme/certificate-authorities) — choose staging or |
| 32 | production, configure ZeroSSL external account binding, and understand account keys. |
| 33 | - [DNS validation](/acme/dns-validation) — configure Cloudflare, validate wildcard |
| 34 | names, tune propagation, and implement a custom solver. |
| 35 | - [Renewal & revocation](/acme/renewal) — schedule deployments, understand |
| 36 | replacement and deletion, and protect persisted keys. |
| 37 | - [Runtime issuance](/acme/runtime) — deploy an authenticated Worker that issues |
| 38 | and revokes certificates, then integrate your own storage and renewal scheduler. |
| 39 | - [Using certificates](/acme/using-certificates) — upload a certificate to Fly |
| 40 | or pass its outputs to another TLS consumer. |
| 41 | - [Troubleshooting](/acme/troubleshooting) — diagnose DNS failures, CA rejection, |
| 42 | rate limits, and runtime connectivity. |
| 43 | |
| 44 | ## Security and lifecycle |
| 45 | |
| 46 | Account and deploy-time certificate private keys are stored in stack state. |
| 47 | `Redacted` masks ordinary logs; it does **not** encrypt your state backend. |
| 48 | Protect the state store, backups, deployment credentials, and any runtime that |
| 49 | receives the account key. |
| 50 | |
| 51 | Renewal needs execution: a certificate resource checks its expiry when you deploy, |
| 52 | not in a background process. Runtime-issued certificates are not tracked as stack |
| 53 | resources. In either mode, monitor expiry and arrange renewal before relying on a |
| 54 | certificate in production. |
| 55 | |
| 56 | ## API reference |
| 57 | |
| 58 | The generated references document each property and method: |
| 59 | |
| 60 | - [Account](/providers/acme/account) |
| 61 | - [Certificate](/providers/acme/certificate) |
| 62 | - [IssueCertificate](/providers/acme/issuecertificate) |
| 63 | - [IssueCertificateHttp](/providers/acme/issuecertificatehttp) |