How does Venafi support ACME-based certificate enrollment?

ACME (Automated Certificate Management Environment) is the protocol Let's Encrypt popularized for fully automated domain-validated issuance, and Venafi supports it from both directions — as a client talking to external ACME CAs, and as an ACME server that internal tools already speaking ACME can point at instead.

As a client, TPP can enroll against public ACME-based CAs the same way it does with any other CA connector, folding Let's Encrypt-issued certificates into the same discovery, monitoring, and renewal pipeline as certificates from commercial CAs. As a server, TPP can expose an ACME-compatible endpoint so that tools built to speak ACME natively — certain Kubernetes ingress controllers, load balancers, or the standard certbot client — can request certificates from TPP's internal policy engine using the exact same protocol they'd use against Let's Encrypt, without needing a Venafi-specific client installed.

This matters because it lets teams standardize on the widely supported ACME protocol at the edge while still routing everything through Venafi's central policy, approval, and audit controls behind the scenes.