ACME, without embedding a client in every app
RFC 8555 ACME support for Let’s Encrypt, with staging as the default environment and production locked until you enable it on purpose.
Why ACME sits behind the API
Embedding an ACME client in every service duplicates account keys, retry logic, and rate-limit handling. sslcertificates.io keeps the ACME conversation in one place and exposes order state through REST and webhooks.
Staging by default
Let’s Encrypt production is disabled unless ACME_PRODUCTION_ENABLED is set. Development and tests use a sandbox CA that speaks the same order and challenge model.
Validation methods
DNS-01 is required for wildcards. HTTP-01 is available for hostnames you can serve from /.well-known/acme-challenge/. Challenges are stored on the order so operators can complete them manually or through DNS automation.