ACME Solutions

Automated Certificate Management Environment (ACME) lets a PKI manage certificates and create a unique set of policies based on the information provided by Apple Managed Device Attestation (MDA). SecureW2’s Managed Gateway API integrates with any mobile device management (MDM) solution, such as Jamf, to distribute the ACME payload through an ACME server and use the managed device attestation to ensure only trusted devices receive a device certificate.

SecureW2 offers certificate-based authentication for Mobile Device Management solutions that auto-enroll managed devices to receive certificates via API gateways. There is an extensive range of APIs for managed devices like SCEP, ACME, JSON, WSTEP, and EST for provisioning and managing certificates on various MDMs like Jamf, Intune, and Google Workspace.

Managed devices generate a key in their secure enclave and provide the required data to the Apple attestation servers to attest their keys. The various factors for attestation are proof that the key is stored in the secure enclave and that the Apple device is authentic and has not been tampered with.

The Secure Enclave on Apple devices houses sensitive data in a secure hardware component. Generally, it stores and manages encryption keys to prevent unauthorized access. However, through Apple's Managed Device Attestation feature, the Apple Secure Enclave is also capable of communicating with Apple’s servers to verify that it’s a genuine Apple device that hasn’t been tampered with. Hardware-bound security features like this provide higher assurance of a device’s authenticity. When using the ACME protocol for certificate issuance, our PKI can now use Apple’s Managed Device Attestation feature and each device’s Secure Enclave to confirm with Apple’s server that a device is genuine before issuing a certificate to it.

Automated Certificate Management Environment (ACME) automates managing certificates to minimize human intervention and reduce the scope for errors. To automate the renewal of SSL certificates through a generic ACME server (not SecureW2), follow these steps:

1. Install a certificate manager on the web server.
2. Upon installation, the agent can communicate with the certificate authority to manage certificates.
3. The agent shares a pair of keys with the CA, who validates the domain and agent authorization.
4. The agent initiates a Certificate Signing Request (CSR) for the respective domain.
5. The agent signs the CSR with his private key.
6. The CSR is verified by the agent who issues a certificate.
7. Upon receipt, the agent installs the domain certificate.
8. The renewal agent is configured similarly, automating the process of issuance and renewal without the need for manual intervention.

To set and validate ACME, select an ACME-compatible agent for the domain that needs management. Ensure domain compatibility with the CA to communicate and generate a pair of keys for certificate-based validation. ACME v2 also supports issuing Wildcard SSL/TLS certificates.

Yes, a Public Key Infrastructure (PKI) streamlines the ACME protocol for certificate management since a PKI provides all the necessary infrastructure to support the generation of certificates.

Digital certificates have proven to be the strongest form of authentication compared to passwords, and you require a PKI in order to issue and managed certificates for a range of use cases, such as SSL certificates or certificates for Wi-Fi access. However, the manual distribution of certificates to devices can get cumbersome and carry the risk of misconfiguration.

The ACME protocol can be used with a PKI to ease the process of distributing SSL and PKI certificates across the organization in an automated manner. It reduces the risk of misconfiguration, as misconfigured certificates risk exposing your network to MITM attacks and leaving it vulnerable to malicious breaches.

Yes, you can use Simple Certificate Enrollment Protocol (SCEP) and ACME simultaneously as an organization. The Simple Certificate Enrollment Protocol (SCEP) automates certificate issuance by helping managed devices enroll for a certificate through a URL and shared secret to communicate with a PKI. SCEP is widely used in MDMs to push a payload with the URL and the shared secret to their managed devices.

ACME is relatively newer and automates certificate management in MDMs. With ACME, managed Apple devices can automatically ask a CA for a certificate. Apple Managed Device Attestation lets a managed Apple device talk to the Apple server and authenticate itself before it can be issued a digital certificate. Since the use of ACME with MDM’s is in an early stage of adoption, most organization use SCEP for the majority of their devices, and use ACME for select Apple devices that perform critical, high-risk functions.

Yes, the ACME protocol can be used for the Windows Operating system and is not exclusive to Apple devices. An ACME Client can be used for Windows OS and PKI/SSL certificates. However, the administrator has to ensure that the ACME server can connect with the Windows server and be configured to issue a valid client certificate to users and devices.

However, SecureW2’s Managed Gateway API leverages ACME for managed Apple devices only. It performs a managed device attestation with the Apple device attestation servers so that the device can enroll itself for a digital certificate.

For other certificate issuance protocols like SCEP, WSTEP, or SAML, SecureW2’s PKI supports the Windows Operating System, along with all the other major vendors.

Yes, in general the ACME protocol can automate the entire certificate issuance, renewal, and revocation process. Most solutions achieve this by installing an agent on the server for regular scheduling and maintenance activities. By automating the certificate management process, organizations can reduce the time and manpower needed to maintain certificates regularly. They also reduce the chance of misconfiguration due to manual configuration, leaving your network vulnerable to MITM and hacking attacks. ACME reduces the overall cost of certificate management as it is an open-source protocol.

You should install an ACME agent that generates a CSR for the required domain to automate certificate management with ACME. The agent validates the requisition process, and the CA issues a certificate after verifying the CSR and the domain. Upon receipt, the certificate is installed in the appropriate domain for a seamless authentication experience whenever a device wants to connect to a network and ensuring network security. At the time of writing (07/09/24), SecureW2 does not offer an ACME agent for servers.