Security Tools › PKI & Certificates › Protocols & APIs

ACME test runner

Run real checks against an ACME certificate authority straight from your browser: the directory, fresh nonces and a signed request, each with a clear result. The toolkit beside it explains every RFC 8555 step.

2 free tools
Live checks from your browser
RFC 8555

Protocols & APIs

How certificates are requested, issued, constrained and checked — with decoders, builders and ready-to-run commands.

ACME test runner RFC 8555 · live checks from your browser New

Run real checks against an ACME certificate authority: directory, nonces, a signed request and replay protection. Then pre-flight your CSR, your CAA records and your dns-01 TXT record before you order. Each step shows a green, amber or red light, and the JSON trace records every request and answer for a support ticket.

Your browser talks to the CA and to Google Public DNS directly; nothing goes through CSMIC. The signed request uses a one-time key made in this tab and only asks whether an account exists (onlyReturnExisting), which the CA must refuse — no account, order or certificate is created.

Server

ACME server

Domain names (optional — for the CAA and dns-01 checks)

Optional pre-flight

CSR you will send at finalize (PKCS#10)

Load file

dns-01 TXT value to look for

Checked at _acme-challenge. of the first domain name.

Passed
Warning
Failed
Skipped

ACME toolkit RFC 8555 · Let's Encrypt · ZeroSSL · Google New

AccountnewAccount Register a key pair with the CA.
OrdernewOrder List the names you want.
Prove controlhttp-01 · dns-01 · tls-alpn-01 Publish a key authorization.
Finalizefinalize Send your CSR (PKCS#10).
Downloadcertificate Fetch the chain (PEM).
RenewrenewalInfo (ARI) Ask the CA when to renew.

Challenge values (key authorization)

Account public key (JWK JSON)

Challenge token

Domain

Decode an ACME request (JWS)

Flattened JWS JSON or compact JWS (from client logs or debug output)

ACME directories

Certificate authority

Paste a directory response to read it

Client commands

Always try the staging endpoint first; production has rate limits.

# certbot, HTTP challenge, staging
certbot certonly --staging --webroot -w /var/www/html -d example.com -d www.example.com

# acme.sh, DNS challenge (pick your DNS provider plugin)
acme.sh --issue --staging --dns dns_cf -d example.com -d '*.example.com'

# lego, TLS-ALPN challenge
lego --server https://acme-staging-v02.api.letsencrypt.org/directory --email you@example.com --domains example.com --tls run

# Check what the CA would see for dns-01
dig +short TXT _acme-challenge.example.com