Protocols and standards for automating the process of requesting, issuing, and renewing digital certificates from Certificate Authorities, including ACME, SCEP, EST, and CMP. It is widely adopted across industries to safeguard digital assets and reduce security risks.
Certificate Enrolment Protocols
Certificate Enrolment Protocols are the family of standards that automate the lifecycle of a digital certificate — requesting it, proving control of an identity, having a Certificate Authority issue it, and renewing it before it expires. The best known is ACME (RFC 8555), the protocol behind Let’s Encrypt, but the family also includes SCEP, EST (RFC 7030), and CMP (RFC 4210), each aimed at a different provisioning context from device fleets to enterprise PKI.
- ACME - Automated Certificate Management Environment, RFC 8555, the modern default for web TLS and increasingly for internal services.
- EST - Enrollment over Secure Transport, RFC 7030, a TLS-based successor to SCEP favored in enterprise and IoT PKI.
- CMP - Certificate Management Protocol, RFC 4210, a full-lifecycle protocol for managing certificates in complex PKI hierarchies.
- SCEP - Simple Certificate Enrollment Protocol, RFC 8894, long used for network devices and mobile-device management.
In real API operations these protocols are what keep TLS from becoming a manual, error-prone chore. Automated enrolment means certificates rotate on a short, machine-managed cadence instead of quietly expiring and taking an API offline. As mutual TLS and workload identity spread across service meshes and agentic infrastructure, certificate enrolment moves from a once-a-year human task to a continuous, automated control plane — the same reliability discipline I look for in security.txt and other machine-checkable trust signals.
