Lion Cipher Lab
Automate TLS certificates with ACME (locally, no public domain)
- Identity & Access Management
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The single most common way TLS breaks in the real world is embarrassingly dumb: a certificate expired and nobody renewed it, so a site or an internal API went dark. Hand-signing certificates with OpenSSL or `step ca certificate` guarantees this outage eventually — because it puts a human on a calendar reminder for something that must happen forever, on every service, without fail. ACME is the protocol that deleted that failure mode: a client proves it controls a name, the CA issues a certificate, and the client renews automatically before expiry, with no human involved. It is what Let's…
What you'll learn
- how the ACME protocol works: account, order, authorization, challenge, CSR, issuance, renewal
- the three challenge types (HTTP-01, DNS-01, TLS-ALPN-01) and when each is required
- enabling an ACME provisioner on step-ca so it issues certs like Let's Encrypt does — but for internal names
- obtaining a certificate with an ACME client (certbot) over HTTP-01
- proving automatic renewal works with `certbot renew --dry-run` and a renewal timer/cron
- why automated short-lived certificates beat hand-signing certs with OpenSSL
- the operational reality of public ACME: staging vs production, rate limits, and shrinking certificate lifetimes
Steps in this lab
- Why automate at all — the OpenSSL/step trap you already hit
- The ACME flow, in plain terms
- The three challenges — and when DNS-01 is the only option
- Stand up a local ACME server (turn your step-ca into one)
- Install an ACME client (certbot)
- Get your first certificate over HTTP-01
- Prove renewal is automatic — the whole reason you did this
- The operational reality when the CA is public (Let's Encrypt)
- What you built — and where it goes next