RFC Compliance

The Akāmu ACME framework implements 23 IETF RFCs and standards — 21 fully, 2 partially.

Full (21)

Partial (2)

RFC	Title	Status	Notes
RFC 8555	Automatic Certificate Management Environment (ACME)	Full	Foundation — HTTP API, JSON model, JWS auth, challenge framework.
RFC 5280	X.509 Certificate and CRL Profile	Full	Certificate structure conformance via synta-certificate library.
RFC 6960	Online Certificate Status Protocol (OCSP)	Full	POST and GET endpoints for revocation status queries.
RFC 7807	Problem Details for HTTP APIs	Full	All error responses use application/problem+json format.
RFC 8659	DNS Certification Authority Authorization (CAA)	Full	CAA record lookup before issuance with DNS tree walking.
RFC 8657	CAA Extensions: accounturi and validationmethods	Full	CAA parameters restricting issuance by method and account.
RFC 8737	ACME TLS-ALPN-01 Challenge Extension	Full	TLS certificate validation on port 443; TLS 1.2 & 1.3 support.
RFC 8738	ACME IP Identifier Validation	Full	IPv4 and IPv6 support via http-01 and tls-alpn-01.
RFC 8739	Short-Term, Automatically Renewed (STAR) Certificates	Full	Continuous short-lived certificate stream with cancel endpoint.
RFC 8823	ACME Extensions for S/MIME Certificates	Full	Email identifier type; email-reply-00 challenge with DKIM enforcement.
RFC 9115	ACME Profile for Delegated Certificates	Full	IdO/NDC delegation model; CSR template validation; upstream CA integration.
RFC 9444	ACME for Subdomains	Full	ancestorDomain and subdomainAuthAllowed support.
RFC 9447	ACME Challenges Using an Authority Token	Full	tkauth-01 challenge; JWT authority token validation; JTI replay prevention.
RFC 9448	ACME TNAuthList Authority Token	Full	TNAuthList identifier type with tkauth-01 for STIR/SHAKEN.
RFC 9773	ACME Renewal Information (ARI)	Full	Renewal window suggestions and certificate replacement tracking.
RFC 9799	ACME Extensions for .onion Domain Names	Full	onion-csr-01 challenge; conditional http-01 and tls-alpn-01.
RFC 9964	ML-DSA for JOSE and COSE	Full	ML-DSA account key support (44/65/87 variants); JWK type AKP.
draft-ietf-acme-profiles	ACME Certificate Profiles	Full	Profile advertisement in directory; profile selection in orders.
draft-ietf-acme-authority-token-jwtclaimcon	ACME Authority Token: JWTClaimConstraints	Full	JWTClaimConstraints identifier type with tkauth-01 validation.
draft-ietf-acme-dns-persist	Persistent DNS Challenge (dns-persist-01)	Full	Long-lived _validation-persist TXT records; no per-renewal changes.
CA/B Forum BR	CA/Browser Forum Baseline Requirements v2.x	Partial	Validity limits, SHA-1 ban, DNSSEC validation, pre-issuance linting enforced. MPIC (BR SS 3.2.2.9) not yet implemented.
draft-ietf-lamps-pq-composite-sigs	Composite ML-DSA Signatures	Full	All 18 composite-sig CA key variants; 11 TLS code points for mTLS. OIDs and SignatureScheme code points are provisional pending IANA allocation.
draft-ietf-plants-merkle-tree-certs	Merkle Tree Certificates (MTC)	Partial	Transparency log, checkpoint signing, tile serving. tile/entries endpoint not yet served; experimental OIDs pending IANA allocation.