What are the ACME protocol and Let's Encrypt?

Short answer

ACME (Automatic Certificate Management Environment) is the protocol used for proving control over a domain automatically and for obtaining and renewing the certificate without human intervention (RFC 8555); the CA verifies the domain with HTTP-01 (a validation response served from port 80 of the domain) or DNS-01 (a temporary TXT record added to the domain). Let's Encrypt is a CA that uses ACME and issues free certificates with a short validity period. In TR7, when the certificate type ACME.SH is selected, letsencrypt, zerossl, sslcom or google is selected in the Acme.sh Server field, the validation method is determined with Challenge Type, and the certificate is renewed automatically at the Acme.sh Automatic Renewal threshold.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → Add → Type = ACME.SH (the default of the form)	Acme.sh Server (letsencrypt default), Challenge Type (HTTP-01 default, DNS-01), Domain and vService table, Acme.sh Key Length, Acme.sh Automatic Renewal (default 30 days before expiry)	Obtaining and renewing the certificate with ACME
ACME.SH form	EAB ID / EAB HMAC (zerossl, sslcom, google)	Binding the ACME account to the customer account at the CA
Certificates & PKI → ACME DNS Providers	Provider Type: Cloudflare, Amazon Route 53, Azure DNS, Generic (acme.sh dnsapi)	The DNS provider that will write the TXT record in DNS-01 validation
SSL/TLS Certificates → preview → ACME.SH tab	Get new certificate, Renew Certificate; run records	Monitoring the obtaining and renewal operations, or triggering them manually

Common Misconceptions

• "ACME is only for Let's Encrypt." ACME is a protocol; in TR7, the ZeroSSL, SSL.com and Google ACME servers can also be selected. Some of them require EAB information (What is EAB (External Account Binding) in ACME?).
• "ACME certificates are renewed manually." TR7 automatically renews the ACME.SH certificates that reach the threshold, and the vServices that use the certificate serve the new one without any additional operation; renewal can also be triggered manually from the preview.
• "For HTTP-01, the vService does not need to be reachable from the internet." In HTTP-01, the CA sends a request to port 80 of the domain; if there is no access, DNS-01 is used (What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?).

How it is done in the documentation

• SSL/TLS Certificates · ACME.SH
• SSL/TLS Certificates · Challenge Type
• ACME DNS Providers · What Is an ACME DNS Provider?

Related questions

• Can I get certificates automatically with Let's Encrypt / ACME?
• What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?
• Which DNS providers are supported for the ACME DNS challenge?
• What is a CAA record; why does it matter when obtaining certificates with ACME?