Automated Certificate Management Environment (ACME) protocol is a new PKI enrollment standard used by several PKI servers such as Let’s Encrypt. The Let’s encrypt certificate allows for free usage of Web server certificates in SRX Series Firewalls, and this can be used in Juniper Secure Connect and J-Web. 

The Junos OS automatically re-enroll Let’s Encrypt certificates on occurrence of every 25 days. But this value can be changed as per our requirement. 

To do so, we can set the re-enrolment date and SRX will automatically do the re-enrolment in that date. 

root@SRX# set security pki auto-re-enrollment acme certificate-id TEST re-enroll-time ?

Possible completions:

<[Enter]>           Execute this command

+ apply-groups        Groups from which to inherit configuration data

+ apply-groups-except Don't inherit configuration data from these groups

 days                Re-enrollment trigger time in days ahead of expiration

For example, consider the below dates as the certificate validity: 

Not before: 1/1/2025

Not After: 3/30/2025

That is the certificate is valid for 90days. So, by default every 25 days the auto re-enrolment will take place. But if we set the re-enrolment time to say 80 days: 

root@SRX# set security pki auto-re-enrollment acme certificate-id TEST re-enroll-time days 80

It means that the auto re-enrolment should happen 80 days before the expiration of the certificate. Hence, every 10 days the auto re-enrolment happens. 

ACME Protocol