ACME TLS on a private networkAutomated Certificate Management on a private network
The Challenge
Public SSL/TLS certificate lifetimes are being progressively reduced. From March 2027, certificates will have a maximum lifetime of 100 days, falling further to 47 days from March 2029. This significantly increases the frequency of certificate renewal and the management overhead for operational teams.
Rather than repeatedly renewing and deploying certificates manually, the move to shorter certificate lifetimes creates a strong case for automating the certificate lifecycle using ACME (Automated Certificate Management Environment).
ACME is supported by a growing range of web servers, operating systems, DNS and cloud platforms. It can also be used with certificate authorities such as Let’s Encrypt, which provides free publicly trusted certificates and supports automated certificate issuance and renewal.
The Issue
For ACME HTTP validation, Let’s Encrypt needs to make an inbound HTTP connection to the system requesting the certificate. This presented a problem because the target server was hosted on a private IP address with no direct inbound route from the internet.
A public IP address and corresponding internet-facing DNS record were therefore required to provide an endpoint that Let’s Encrypt could reach and validate. Traffic to this address would need to be securely routed to the internal server.
Internal devices, however, accessed the service directly using its private IP address. The certificate therefore also needed to include the private IP address as a Subject Alternative Name (SAN), allowing those connections to validate the same certificate successfully.
The solution needed to provide:
A controlled internet-facing HTTP endpoint for ACME validation.
Translation and routing from the public address to the privately addressed server.
A certificate containing both the public and private IP addresses.
Automated certificate issuance and renewal without exposing the internal server directly to the internet.
A cost-effective solution which made effective use of existing infrastructure, as there was no project budget associated with the requirement.
The Solution
The solution used the existing network and Azure connectivity, with an Azure Application Gateway introduced to provide the controlled internet-facing endpoint required for ACME validation.
The certificate request was configured with Subject Alternative Names (SANs) for the service URL and private IP address, allowing the resulting certificate to be used by devices resolving the service internally.
The Application Gateway was configured with a public IP address, which was registered in internet-facing DNS for certificate validation. Port 80 was enabled for the validation request, with traffic routed through the private network and across the existing site-to-site VPN to the on-premises server.
Security was maintained using both perimeter and local firewalls, restricting HTTP traffic to the required path between the Application Gateway and the server. This provided the inbound connectivity required for automated certificate validation without making the server itself directly accessible from the internet.
The ACME process
The solution
