What this POC tests
Certificates are renewed by software instead of by hand. An ACME client on each server asks the certificate authority for a new certificate before the old one expires, then reloads the web server so it starts using it.
Issue
The ACME client registers with Sectigo, proves control of the domain and receives a certificate.
Deploy
The certificate is installed in the web server, which is reloaded without downtime.
Renew
A scheduled job renews the certificate before expiry, with no one involved.
This test host
- Hostname
poc-acme-linux.fpcops.io- Operating system
- Ubuntu 24.04 LTS
- Web server
- nginx
- ACME client
- certbot
- Certificate authority
- Sectigo Public CA, using ACME with external account binding (OV certificate)
- Domain validation
- DNS TXT record, validated in Sectigo Certificate Manager
- Renewal
- certbot timer, runs twice a day and renews 30 days before expiry
- Cloud region
- AWS Asia Pacific (Mumbai)
- Companion host
- Windows Server 2022 with IIS and win-acme (configured after this host)
- Owner
- Subhajit Dutta
Certificate on this host
- Issued by
- Sectigo Public Server Authentication CA OV E36
- Issued to
- Forcepoint LLC,
poc-acme-linux.fpcops.io - Key type
- ECDSA
- Valid until
- 12 May 2027
Renewal test on 26 October 2026
A forced renewal replaced the certificate while nginx kept running. The new serial number shows that a new certificate was issued and deployed without manual steps.
| Before renewal | After renewal | |
|---|---|---|
| Serial number | 6EF3872DBBA569A688DF95EC5361210A | 172D6A0AE1F75C7F8B28C59519452EE9 |
| Issuer | Sectigo OV E36 | Sectigo OV E36 |
| Deployment | nginx reloaded by the renewal hook, no restart | |
Progress
- Linux and Windows servers created and tagged in AWS MumbaiDone
- DNS records created in Route 53Done
- Domain fpcops.io validated and delegated in Sectigo Certificate ManagerDone
- nginx running and reachable from the internetDone
- Sectigo ACME account and credentialsDone
- First certificate issued and served over HTTPS on LinuxDone
- Forced renewal verified on Linux, renewal timer activeDone
- Same flow on Windows with IIS and win-acmePending
- POC documentation and test results added to the Jira ticketPending
Results against the success criteria
- Both servers can talk to the ACME serverLinux and Windows reach Sectigo and register an ACME account.
- Renewal runs without manual stepsA scheduled job renews the certificate, and a renewal shows a new serial number.
- Renewed certificates are deployed and validatednginx and IIS serve the new certificate, confirmed with a check from outside the server.
- Documentation and findingsThe setup steps, the automation process and the test results are recorded for the team.
What we learned
- Sectigo ACME accounts that use a certificate profile connect to Sectigo’s enterprise ACME endpoint, not to the public version endpoints.
- Domain delegation in the certificate manager must allow subdomains before a host name can be enrolled.
- Domain validation in the certificate manager expires before the renewal window opens, so it needs revalidation or automation in a real deployment.
- Credentials for the ACME account belong in a root-only file, because the client logs its command line.
This is a temporary test system. It holds no production data and will be removed when the POC ends.