# version 21.1 ACME setup for certificate renewal with Digicert
**URL:** https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157
**Category:** Technical Forums
**Tags:** application-delivery
**Created:** [May 29, 2026, 3:25am UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157 "2026-05-29T03:25:33Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@awan\_m](https://community.f5.com/u/awan_m)
#### Post date: [May 29, 2026, 3:25am UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157/1 "2026-05-29T03:25:33Z")
Hello - i have installed Bigip version 21.1 and want to configure ACME to automate Certificate renewal from Digicert and our internal CA.
has any one configured it yet ? and are there any documents that guide on how to configure … maybe a video
thanks
---
### Author:  [@Anoop\_Jayadharan](https://community.f5.com/u/Anoop_Jayadharan)
#### Post date: [June 2, 2026, 10:29am UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157/2 "2026-06-02T10:29:53Z")
Hey @awan_m
See if it helps you to start with.
[https://www.youtube.com/watch?v=nee8F4Pt4Vc](https://www.youtube.com/watch?v=nee8F4Pt4Vc)
[https://docs.digicert.com/de/trust-lifecycle-manager/integration-guides/f5-big-ip-ltm-integration.html](https://docs.digicert.com/de/trust-lifecycle-manager/integration-guides/f5-big-ip-ltm-integration.html)
---
### Author:  [@awan\_m](https://community.f5.com/u/awan_m)
#### Post date: [June 2, 2026, 10:06pm UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157/3 "2026-06-02T22:06:44Z")
thanks for the reply - but none of these help with setting up Acme agent that is now on F5 - the video and document are for digicert sensor implementation
---
### Author:  [@Daniel\_Wolf](https://community.f5.com/u/Daniel_Wolf)
#### Post date: [June 3, 2026, 3:35pm UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157/4 "2026-06-03T15:35:40Z")
Hi @awan_m ,
take a look here:
> **[ACME Provider Setup - SSL Certificate Management | BIG-IP Documentation](https://techdocs.f5.com/en-us/bigip-21-1-0/big-ip-system-ssl-administration/ssl-certificate-management.html#acme-provider-setup)**
>
> Updated Date: 09/02/2026 | Usage information and technical documentation for BIG-IP and other related F5 products
KR
Daniel
---
### Author:  [@Kevin\_Stewart](https://community.f5.com/u/Kevin_Stewart)
#### Post date: [July 29, 2026, 4:41pm UTC](https://community.f5.com/t/version-21-1-acme-setup-for-certificate-renewal-with-digicert/77157/5 "2026-07-29T16:41:52Z")
A little late to the conversation, but please also review the following article:
[Automatic Certificate Management with ACMEv2 in F5 BIG-IP | DevCentral](https://community.f5.com/topic/346795)
I will also provide some additional guidance inline below.
**Step 1: Create an HTTP virtual server** :
The ACMEv2 HTTP-01 validation requires that the ACME be able to challenge an HTTP:80 listener on the IP address resolved from public DNS. Your BIG-IP needs an HTTP:80 VIP that will listen for this challenge request and respond with a token provided by the ACME server at the beginning of the transaction. For BIG-IP ACMEv2 support you simply need an LTM VIP listening on port 80, with an HTTP profile attached, and the “ACMEv2 Challenge” option enabled.
_Navigate to Local Traffic --\> Virtual Servers_
```bash
tmsh create ltm virtual www.f5labs.local \
destination 10.1.10.120:80 \
profiles replace-all-with { tcp http } \
acmev2-challenge enabled \
vlans replace-all-with { client-vlan } \
vlans-enabled
```
This will handle requests to /.well-known/acme-challenge. If the HTTP:80 VIP is also used to auto-redirect to the HTTPS site, you’ll need to modify the redirect iRule to ignore this URL.
```tcl
when HTTP_REQUEST {
if { !([HTTP::uri] starts_with "/.well-known/acme-challenge") } {
HTTP::redirect https://[getfield [HTTP::host] ":" 1][HTTP::uri]
}
}
```
---------------------------
**Step 2: Create a DNS resolver**
The resolver is used here to provide a resolution path for the ACME client to find the ACME service(s) and is attached to an internal proxy object.
_Navigate to Network --\> DNS Resolvers_
```bash
tmsh create net dns-resolver acme-resolver \
{ forward-zones replace-all-with \
{ . { nameservers replace-all-with { 10.1.10.53:53 }}}}
```
---------------------------
**Step 3: Add an ACME CA bundle**
The CA bundle is needed to validate the TLS communications with the ACME service. For an Internet ACME service, like Lets Encrypt, it may be sufficient to use the built-in “ca-bundle” or “blended-bundle”.
_Navigate to System --\> Certificate Management --\> Traffic Certificate Management --\> SSL Certificate List_
---------------------------
**Step 4: Create the ACME account key**
The ACME account key is used to create an account registration with the ACME service. This is typically just a self-signed certificate. For ACME services that require EAB you’d still create this key, but EAB would be used for “pre-authentication”.
_Navigate to System --\> Certificate Management --\> Traffic Certificate Management --\> SSL Certificate List_
```bash
tmsh create sys crypto key acme-account-key
tmsh create sys crypto cert acme-account-key \
key acme-account-key \
common-name acme-account-key \
subject-alternative-name DNS:acme-account-key
```
---------------------------
**Step 5: Create the internal proxy object**
The internal proxy provides the routing path to the ACME service on the BIG-IP data plane, and supports both routed and explicit proxy connectivity.
_Navigate to System --\> Services --\> Internal Proxies_
```bash
tmsh create sys internal-proxy acme-proxy { dns-resolver acme-resolver route-domain 0 }
```
---------------------------
**Step 6: Create an ACME provider**
An ACME provider defines how to connect to a specific ACME service (ex. Lets Encrypt), and includes the directory URL path and any authentication requirements.
_Navigate to System --\> Certificate Management --\> Traffic Certificate Management --\> ACME Provider List_
```bash
tmsh create sys crypto acme-provider acme-provider-letsencrypt \
internal-proxy acme-proxy \
trusted-ca-cert acme-bundle \
directory-url https://acme-staging-v02.api.letsencrypt.org/directory \
account-key acme-account-key \
challenge-type { http-01 } \
accepted-tos true \
account-action activate
```
---------------------------
**Step 7: Generate a certificate from CSR**
You can now generate an ACME request directly from a key and CSR.
_Navigate to System --\> Certificate Management --\> Traffic Certificate Management --\> SSL Certificate List_
```bash
tmsh create sys crypto \
key www.f5labs.local \
gen-csr www.f5labs.local \
common-name www.f5labs.local \
subject-alternative-name DNS:www.f5labs.local \
organization f5labs.local \
city omaha \
state ne \
country us \
key-type rsa-private \
key-size 2048 \
key-usage "keyAgreement,digitalSignature,keyEncipherment" \
acme-provider add { acme-provider-letsencrypt { order-type new identifiers none } }
```
You can also spawn an ACME renewal directly from an existing cert/key. Open/edit a cert/key object, go to the key tab, select an ACME provider, and set ACME order Type to ‘New’ or ‘Renew’ and then click the Update button. Periodically click the Refresh button to check the status.
Thanks.