Subject: [Acme] Questions on ACME Protocol: Wildcard Certificate Distribution & Certificate Pinning for Mobile Apps
From: Marin Mihajlović <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Fri, 10 Apr 2026 11:25:21 +0000
List-Id: Automated Certificate Management Environment <acme.ietf.org>

Hello,

I hope this message finds you well. I'm reaching out to the ACME Working Group with two questions regarding challenges we're facing in our certificate lifecycle management, and I'd appreciate any insights, recommendations, or pointers to existing work in this area.

1. Wildcard Certificate Distribution Across Multiple Servers

We currently use the ACME protocol to automatically renew a wildcard certificate on a single server. However, the same certificate and private key are used for TLS termination on multiple servers. At the moment, we lack an automated mechanism to distribute the renewed certificate and private key to all other servers that depend on it.

Does the working group have any recommendations or best practices for handling this scenario? Are there any existing extensions, draft proposals, or commonly adopted patterns within the ACME ecosystem that address automated distribution of certificates and private keys to multiple endpoints after renewal?

2. Certificate Pinning in Mobile Applications

We maintain mobile applications that implement certificate pinning. Each time a certificate is renewed, we currently need to build and release a new version of the app with the updated pinned certificate. This creates an operational bottleneck and a window of potential service disruption.

Is there any work being done within the ACME protocol or related specifications to help coordinate certificate renewal with certificate pinning scenarios? For example, mechanisms to pre-publish upcoming certificate details (such as public keys or SPKI hashes) ahead of the actual renewal, so that pinning configurations can be updated proactively?

Any guidance, references to relevant RFCs or drafts, or practical experience the group can share would be greatly appreciated.

Thank you for your time.

Best regards,

Marin Mihajlović
Software Architect

ASEE SOLUTIONS d.o.o.
+385 95 5541 310 | [email-masked]<mailto:[email-masked]>

asee<https://asee.io>.io<https://asee.io>

<http://www.linkedin.com/company/asseco-south-eastern-europe>   <http://twitter.com/Asseco_SEE>    <https://www.facebook.com/Asseco-SEE-Hrvatska-310088196054642/>