[](https://www.paloaltonetworks.com/?ts=markdown) * [](https://www.paloaltonetworks.com/?ts=markdown) * Products Products AI Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) Network Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) SASE [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) Security Operations [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) Cloud Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) Observability ^NEW^ [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) Identity Security [![](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [![Overview icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Overview](#products-panel-0) * [![AI Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) AI Security](#products-panel-1) * [![Network Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Network Security](#products-panel-2) * [![SASE icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-prisma-blue.svg) SASE](#products-panel-3) * [![Security Operations icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Security Operations](#products-panel-4) * [![Cloud Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Cloud Security](#products-panel-5) * [Observability ^NEW^](#products-panel-6) * [![Identity Security icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Identity Security](#products-panel-7) [See All Products](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) [![AI Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg) AI Security Discover, assess and protect AI apps, agents and employee use of GenAI tools](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [![Network Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg) Network Security AI-powered NetSec with next-gen firewalls, inline defense and unified management](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Security Operations icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg) Security Operations Stop cyberattackers with the industry's premier platform for autonomous security operations](https://www.paloaltonetworks.com/cortex?ts=markdown) [![Observability \& Remediation NEW icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg) Observability \& Remediation ^NEW^ Prevent downtime with the AI-driven platform that delivers autonomous remediation](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![SASE icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg) SASE Protect with AI, secure AI use and operate with AI using agentic Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) [![Identity Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg) Identity Security Identity security platform to secure every identity: human, machine and agentic](https://www.paloaltonetworks.com/idira?ts=markdown) [![Cloud Security icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg) Cloud Security Prevent risks from code to cloud with the leading agentic cloud security platform](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![AI Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-AIRS-logo-nav.svg)](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) [AI Security Platform](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Gateway](https://www.paloaltonetworks.com/ai-security/ai-gateway?ts=markdown) * [AI Supply Chain Security](https://www.paloaltonetworks.com/ai-security/ai-supply-chain-security?ts=markdown) * [AI Red Teaming](https://www.paloaltonetworks.com/ai-security/ai-red-teaming?ts=markdown) * [AI Runtime Security](https://www.paloaltonetworks.com/ai-security/ai-runtime-security?ts=markdown) * [Agent Identity Security](https://www.paloaltonetworks.com/ai-security/agent-identity-security?ts=markdown) * [AI Posture Management](https://www.paloaltonetworks.com/prisma/cloud/ai-spm?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) Secure GenAI Tools * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) [![Network Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/strata-logo-nav.svg)](https://www.paloaltonetworks.com/network-security?ts=markdown) [Secure the Network](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [OT / Industrial Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [Device \& IoT Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown) * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) [Cloud-Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense?ts=markdown) * [Quantum Safe Security](https://www.paloaltonetworks.com/network-security/quantum-safe-security?ts=markdown) * [Next-Gen Trust Security](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) [![SASE logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/prisma-sase-logo-nav.svg)](https://www.paloaltonetworks.com/sase?ts=markdown) [Secure Access (SASE)](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma Access (ZTNA)](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) [![Security Operations logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-logo-nav.svg)](https://www.paloaltonetworks.com/cortex?ts=markdown) [Security Operations](https://www.paloaltonetworks.com/cortex?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Security Orchestration \& Automation](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown) * [Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown) * [Threat Intelligence Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown) * [Agentic-first Automation](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown) * [Identity Threat Detection and Response](https://www.paloaltonetworks.com/cortex/itdr?ts=markdown) [Endpoint Security](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown) * [Agentic Endpoint Security](https://www.paloaltonetworks.com/cortex/agentic-endpoint-security?ts=markdown) * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown) [Data Security](https://www.paloaltonetworks.com/cortex/data-security?ts=markdown) [![Cloud Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/cortex-cloud-logo-nav.svg)](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [Application Security Overview](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Application Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown) * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown) * [Infrastructure-as-Code (IaC) Security](https://www.paloaltonetworks.com/cortex/cloud/infrastructure-as-code-security?ts=markdown) * [Software Composition Analysis](https://www.paloaltonetworks.com/cortex/cloud/software-composition-analysis?ts=markdown) * [Secrets Security](https://www.paloaltonetworks.com/cortex/cloud/secrets-security?ts=markdown) * [Open Partner Ecosystem](https://www.paloaltonetworks.com/cortex/cloud/appsec-partner-ecosystem?ts=markdown) [Cloud Posture Security Overview](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown) * [Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown) * [Data Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown) * [AI Security Posture Management](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown) * [Vulnerability Management](https://www.paloaltonetworks.com/cortex/cloud/vulnerability-management?ts=markdown) * [Cloud Attack Surface Management](https://www.paloaltonetworks.com/cortex/cloud/attack-surface-management?ts=markdown) [Cloud Runtime Security Overview](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Cloud Detection and Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown) * [Container \& Kubernetes Security](https://www.paloaltonetworks.com/cortex/cloud/kubernetes-and-container-security?ts=markdown) * [Cloud Workload Protection](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown) * [API Security](https://www.paloaltonetworks.com/cortex/cloud/api-security?ts=markdown) * [Serverless Security](https://www.paloaltonetworks.com/cortex/cloud/serverless-security?ts=markdown) [![Observability NEW logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cortex/xcor/cortex-xcor-logo-nav-2.svg)](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) Observability \& Remediation * [AI-Driven Observability](https://www.paloaltonetworks.com/cortex/xcor/ai-driven-observability?ts=markdown) * [Distributed Tracing](https://www.paloaltonetworks.com/cortex/xcor/distributed-tracing?ts=markdown) * [Log Management](https://www.paloaltonetworks.com/cortex/xcor/log-management?ts=markdown) * [Metrics Monitoring](https://www.paloaltonetworks.com/cortex/xcor/metrics-monitoring?ts=markdown) [![Identity Security logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/idira-logo-nav.svg)](https://www.paloaltonetworks.com/idira?ts=markdown) [Human Identities](https://www.paloaltonetworks.com/idira/human?ts=markdown) * [Modern PAM](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) [Machine Identities](https://www.paloaltonetworks.com/idira/machine?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * Solutions Solutions By Use Case [![Drive AI Transformation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/ai-page/teaser-block/teaser-icon-2.svg) Drive AI Transformation Scale enterprise AI adoption across employees, applications and agents with confidence and control](https://www.paloaltonetworks.com/ai-security?ts=markdown) [![Accelerate Cloud Transformation icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Accelerate Cloud Transformation Build fast and innovate fearlessly with AI-driven protection from code to cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) [![Secure AI Coding icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure AI Coding Let AI coding do more, with you in control. Protect data, govern agents and control AI costs](https://www.paloaltonetworks.com/secure-ai-coding?ts=markdown) [![Secure Every Identity icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-idira.svg) Secure Every Identity Stop identity-led breaches: Secure human, machine, and agentic identities with zero trust](https://www.paloaltonetworks.com/idira?ts=markdown) [![Enable Autonomous SOC icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Enable Autonomous SOC Fight AI with AI to stop threats at machine speed with the power of analytics and automation](https://www.paloaltonetworks.com/cortex/fight-ai-with-ai?ts=markdown) [![Secure Critical Infrastructure icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Secure Critical Infrastructure Stop machine-speed threats across OT, 5G and IoT with AI-driven cyber defense](https://www.paloaltonetworks.com/securing-critical-infrastructure?ts=markdown) [![Secure the Hybrid Network icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-strata.svg) Secure the Hybrid Network Stay ahead of AI-driven attacks with unified network security across hybrid environments](https://www.paloaltonetworks.com/network-security?ts=markdown) [![Automate Root-Cause Analysis icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-cortex.svg) Automate Root-Cause Analysis Respond autonomously to incidents and accelerate remediation with agentic AI](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [![Frontier AI Defense icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/icon-Unit42.svg) Frontier AI Defense Use defender-grade models to stop AI-speed attacks before they start](https://www.paloaltonetworks.com/unit42/ai-advantage?ts=markdown) * Services Services Security Services [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) Customer Services [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Services Overview](#services-panel-0) * [Security Services](#services-panel-1) * [Managed Firewalls](#services-panel-2) * [Customer Services](#services-panel-3) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) [![Security Services logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit-logo-dark.svg)](https://www.paloaltonetworks.com/unit42?ts=markdown) Prepare for Emerging Risks * [AI Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ai-security-assessment?ts=markdown) * [Frontier AI](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Respond to Cyber Attacks](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown) * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown) * [Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed Threat Hunting](https://www.paloaltonetworks.com/cortex/managed-threat-hunting?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/attack-surface-assessment?ts=markdown) * [Breach Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/breach-readiness-review?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/cloud-security-assessment?ts=markdown) * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/compromise-assessment?ts=markdown) * [Ransomware Readiness](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/ransomware-readiness-assessment?ts=markdown) * [Supply Chain](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/supply-chain-risk-assessment?ts=markdown) * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/tabletop-exercises?ts=markdown) * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown) [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Cyber Risk](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/cyber-risk-assessment?ts=markdown) * [IR Plan Development](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/IR-plan-and-development-review?ts=markdown) * [Security Program Design](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/security-program-design?ts=markdown) * [SOC Assessment](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/soc-assessment?ts=markdown) * [Virtual CISO](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/virtual-ciso?ts=markdown) * [Zero Trust](https://www.paloaltonetworks.com/unit42/build-your-security-strategy/zero-trust-advisory?ts=markdown) Understand the Adversary * [Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Offensive Security](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses/offensive-security-services?ts=markdown) Managed Firewalls * [Managed Firewalls - AWS](https://www.paloaltonetworks.com/network-security/cloud-ngfw?ts=markdown) * [Managed Firewalls - Azure](https://www.paloaltonetworks.com/network-security/cloud-ngfw-for-azure?ts=markdown) [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown) * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown) * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown) * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown) * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown) * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown) * Industries Industries [![Financial Services icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/financial-icon-2.svg) Financial Services Secure with AI cybersecurity, fraud and ransomware prevention, compliance, and customer data protection](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown) [![Manufacturing icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/manufacturing-icon-2.svg) Manufacturing Secure with OT security, ransomware defense, industrial cybersecurity, supply chain resilience, and continuity](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown) [![Retail and Hospitality icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/retail-icon-2.svg) Retail and Hospitality Secure with payment security, PCI compliance, ransomware and fraud prevention, and data protection](https://www.paloaltonetworks.com/industry/retail?ts=markdown) [![Healthcare and Life Sciences icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/healthcare-icon-2.svg) Healthcare and Life Sciences Secure patient and clinical data, medical device security, ransomware defense, and HIPAA compliance](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown) [![Public Sector icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/public-sector-icon-2.svg) Public Sector Secure with Zero Trust, cyber defense, compliance, infrastructure protection, and citizen data security](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown) [![Utilities icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/utilities-icon-2.svg) Utilities Secure with power grid protection, OT network security, ransomware defense, and critical infrastructure security](https://www.paloaltonetworks.com/industry/electric-utilities?ts=markdown) [![Transportation icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/transportation-icon-2.svg) Transportation Secure OT and connected infrastructure protection, ransomware defense, supply chain security, compliance](https://www.paloaltonetworks.com/industry/transportation-security?ts=markdown) [![Small and Medium Business icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/smb-icon-2.svg) Small and Medium Business Secure against cyber threats using AI-powered endpoint, network, browser, cloud, and MDR](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown) * Partners Partners NextWave * [Partner Program](https://www.paloaltonetworks.com/partners/nextwave-partner-portal-login?ts=markdown) * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner) * [Request Partner Portal Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess) * [Partner Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown) * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator) Partner Ecosystem [Explore All Partners Find the right partner network tailored to your business needs, cloud environments, and security requirements](https://www.paloaltonetworks.com/partners?ts=markdown) [Cloud Service Partners Bring cloud native security and compliance to the entire development lifecycle](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown) [Frontier AI Alliance Outpace today's cyberattacks through a global ecosystem of leaders orchestrating unified defenses](https://www.paloaltonetworks.com/frontier?ts=markdown) [Global System Integrators Speed and secure digital transformation with the industry's best technology, people and intelligence](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown) [Managed Security Service Providers Gain valuable resource oversight to help your businesses administer security strategies](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown) [Resellers Deliver the most comprehensive cybersecurity portfolio while expanding opportunities and profitability](https://www.paloaltonetworks.com/partners/resellers?ts=markdown) [Service Providers Protect mobile users, devices and applications with effective, flexible and easy to deploy cybersecurity](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown) [Technology Partners Advance security and transformation with innovative technology partner integrations](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown) * Resources Resources ![Learn icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/resource-library-icon.svg) Learn * [Resource Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Analyst Reports](https://www.paloaltonetworks.com/resources/research?ts=markdown) * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown) * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Threat Vector Podcast](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/) * [Knowledgebase](https://knowledgebase.paloaltonetworks.com/) * [Technical Documentation](https://docs.paloaltonetworks.com/) ![Engage icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/engage-icon-2.svg) Engage * [Webinars](https://www.paloaltonetworks.com/resources/webinars?ts=markdown) * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown) * [Test Drive](https://www.paloaltonetworks.com/resources/test-drives?ts=markdown) * [On-Demand](https://www.paloaltonetworks.com/ondemand?ts=markdown) ![Connect icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/connect-icon-2.svg) Connect * [Executive Briefings](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown) * [Events](https://events.paloaltonetworks.com/) * [Live Community](https://live.paloaltonetworks.com/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) ![Discover icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/nav/discover-icon-2.svg) Discover * [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown) * [Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown) * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown) * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown) ![Company icon](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default-orange.svg) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en) * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/) * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown) * [Office Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * ![search magnifying glass](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg) * us Language * USA (ENGLISH) * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au/cyberpedia/what-is-acme-protocol) * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br/cyberpedia/what-is-acme-protocol) * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca/cyberpedia/what-is-acme-protocol) * [CHINA (简体中文)](https://www.paloaltonetworks.cn/cyberpedia/what-is-acme-protocol) * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr/cyberpedia/what-is-acme-protocol) * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de/cyberpedia/what-is-acme-protocol) * [INDIA (ENGLISH)](https://www.paloaltonetworks.in/cyberpedia/what-is-acme-protocol) * [ITALY (ITALIANO)](https://www.paloaltonetworks.it/cyberpedia/what-is-acme-protocol) * [JAPAN (日本語)](https://www.paloaltonetworks.jp/cyberpedia/what-is-acme-protocol) * [KOREA (한국어)](https://www.paloaltonetworks.co.kr/cyberpedia/what-is-acme-protocol) * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat/cyberpedia/what-is-acme-protocol) * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx/cyberpedia/what-is-acme-protocol) * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg/cyberpedia/what-is-acme-protocol) * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es/cyberpedia/what-is-acme-protocol) * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw/cyberpedia/what-is-acme-protocol) * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk/cyberpedia/what-is-acme-protocol) * Accounts \& Support Accounts \& Support * Accounts * Customer * Partner * Employee * [Login to Download](https://www.paloaltonetworks.com/login?ts=markdown) * [Become a Member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown) * Support * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [What's New](https://www.paloaltonetworks.com/resources?ts=markdown) * [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount) [Under Attack?](https://www.paloaltonetworks.com/unit42/contact-unit42?ts=markdown) * [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown) [Introducing Cortex XCOR: Observability, reimagined. Discover now.](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) [](https://www.paloaltonetworks.com/?ts=markdown) Search All * [Tech Docs](https://docs.paloaltonetworks.com/search) Close search modal 1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) 2. [Identity Security](https://www.paloaltonetworks.com/cyberpedia/identity-security?ts=markdown) 3. [Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis?ts=markdown) 4. [What Is the ACME Protocol?](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol?ts=markdown) Table of Contents * [Machine Identity Security: The Definitive Guide](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis?ts=markdown) * [Machine Identity Security Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#machine?ts=markdown) * [Four Pillars of Machine Identity Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#four?ts=markdown) * [Machine Identity in the Attacker Workflow: Unit 42 Observations](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#observations?ts=markdown) * [Cloud Security Implications and Identity Sprawl](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#cloud?ts=markdown) * [Implementing a Machine Identity Security Program](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#program?ts=markdown) * [Machine Identity Security FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis#faqs?ts=markdown) * [What Is an SSL Stripping Attack?](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack?ts=markdown) * [Why SSL Stripping Belongs in Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#why?ts=markdown) * [SSL Stripping Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#sslstripping?ts=markdown) * [How SSL Stripping Works](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#how?ts=markdown) * [Where SSL Stripping Happens](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#where?ts=markdown) * [Signs of SSL Stripping](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#where?ts=markdown) * [Identity-Focused Impact](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#identity?ts=markdown) * [Machine Identity Security Impact](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#machine?ts=markdown) * [How to Prevent SSL Stripping](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#howto?ts=markdown) * [SSL Stripping Prevention Checklist](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#checklist?ts=markdown) * [SSL Stripping FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-an-ssl-stripping-attack#faqs?ts=markdown) * [What Is the TLS Handshake? Process, Steps, and Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake?ts=markdown) * [The Strategic Importance of the TLS Handshake](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#importance?ts=markdown) * [How the TLS Handshake Works: Step-by-Step](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#how?ts=markdown) * [TLS 1.2 vs. TLS 1.3: Evolution of Speed and Security](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#vs?ts=markdown) * [The Role of Cipher Suites and Digital Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#role?ts=markdown) * [Identifying and Resolving TLS Handshake Failures](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#failures?ts=markdown) * [Advanced Security: TLS Fingerprinting and Threat Detection](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#advanced?ts=markdown) * [TLS Handshake Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#best?ts=markdown) * [TLS Handshake FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-handshake#faqs?ts=markdown) * [Security Standards and Compliance: SSL/TLS Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-are-ssl-tls-security-standards-and-compliance?ts=markdown) * [SSL/TLS Security Standards and Compliance Explained](https://www.paloaltonetworks.com/cyberpedia/what-are-ssl-tls-security-standards-and-compliance#security?ts=markdown) * [Use Cases \& Real-World Examples](https://www.paloaltonetworks.com/cyberpedia/what-are-ssl-tls-security-standards-and-compliance#usecase?ts=markdown) * [SSL/TLS Compliance Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-are-ssl-tls-security-standards-and-compliance#compliance?ts=markdown) * [SSL/TLS Security Standards and Compliance FAQs](https://www.paloaltonetworks.com/cyberpedia/what-are-ssl-tls-security-standards-and-compliance#faq?ts=markdown) * [What Is the TLS Certificate Lifecycle? Implementation Guide](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle?ts=markdown) * [TLS Certificate Lifecycle Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#tls?ts=markdown) * [The 6 Core Stages of the TLS Certificate Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#core?ts=markdown) * [Why TLS Certificate Lifecycle Matters](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#why?ts=markdown) * [Key Causes of Certificate Failure](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#key?ts=markdown) * [Validation Checks: CRL and OCSP](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#validation?ts=markdown) * [How Automation Improves TLS Certificate Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#how?ts=markdown) * [TLS Certificate Lifecycle and Zero Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#tls?ts=markdown) * [TLS Certificate Lifecycle FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle#faqs?ts=markdown) * [What Is PKI? Public Key Infrastructure \& Authentication Guide](https://www.paloaltonetworks.com/cyberpedia/what-is-pki?ts=markdown) * [Key Data: Threats and Trends](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#key?ts=markdown) * [Why PKI Matters for Modern Organizations](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#why?ts=markdown) * [How PKI Works: The Asymmetric Model](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#how?ts=markdown) * [Key Components of a PKI Framework](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#key?ts=markdown) * [Common Risks and Implementation Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#common?ts=markdown) * [PKI Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#best?ts=markdown) * [PKI in a Zero Trust Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#architecture?ts=markdown) * [Public Key Infrastructure (PKI) FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-pki#faqs?ts=markdown) * [What Is a TLS Certificate? How TLS Secures Web Communication](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate?ts=markdown) * [TLS Certificate Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#explain?ts=markdown) * [The TLS Handshake Process](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#process?ts=markdown) * [TLS vs SSL Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#certificates?ts=markdown) * [Critical Use Cases For TLS](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#critical?ts=markdown) * [TLS Machine Identity Security Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#machine?ts=markdown) * [5 Pillars Of Certificate Management](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#pillar?ts=markdown) * [The Role Of Certificate Authorities](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#role?ts=markdown) * [Unit 42 Threat Insights: Certificate Abuse](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#abuse?ts=markdown) * [TLS Certificate FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate#faqs?ts=markdown) * [What Is a Self-Signed Certificate? Risks, Uses \& Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate?ts=markdown) * [Self-Signed Certificates Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#explained?ts=markdown) * [Use Cases \& Real-World Examples](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#examples?ts=markdown) * [How It Works](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#how?ts=markdown) * [Self-Signed Certificate Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#best?ts=markdown) * [Risks \& Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#challenges?ts=markdown) * [Unit 42 Intelligence: Attack Patterns](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#patterns?ts=markdown) * [Self-Signed Certificates FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-self-signed-certificate#faqs?ts=markdown) * [What Is Certificate Management?](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management?ts=markdown) * [Certificate Management Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#certificate?ts=markdown) * [Core Capabilities of Certificate Management](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#core?ts=markdown) * [Common Challenges: The "Red Flag" Checklist](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#challenges?ts=markdown) * [How Certificate Management Supports Zero Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#how?ts=markdown) * [Implementation Roadmap: Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#implementation?ts=markdown) * [Certificate Management vs. TLS Certificate Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#certificate?ts=markdown) * [Certificate Management FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-management#faqs?ts=markdown) * [What Is Certificate Validation? Guide to Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation?ts=markdown) * [Certificate Validation Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#validation?ts=markdown) * [The Role of Certificate Authorities and the Chain of Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#role?ts=markdown) * [The Hierarchy of Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#trust?ts=markdown) * [The Sequence of the Validation Process](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#process?ts=markdown) * [Types of Certificate Validation Levels](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#levels?ts=markdown) * [Unit 42 Insights: The Risk of Identity Exposure](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#insight?ts=markdown) * [Threat Behavior Observations](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#behavior?ts=markdown) * [Troubleshooting Common Validation Failures](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#troubleshoot?ts=markdown) * [Certificate Validation FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-validation#certificate?ts=markdown) * [What Is TLS Certificate Renewal? Process, Risks \& Automation](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal?ts=markdown) * [TLS Certificate Renewal: The Shift from Maintenance to Mission-Critical](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#certificate?ts=markdown) * [Why the 47-Day Mandate Redefines Renewal Strategy](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#mandate?ts=markdown) * [The Technical Lifecycle of a TLS Renewal](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#technical?ts=markdown) * [Critical Risks: The High Cost of Renewal Failure](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#critical?ts=markdown) * [Best Practices for Enterprise-Scale Renewal](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#best?ts=markdown) * [Overcoming Common Renewal Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#common?ts=markdown) * [TLS Certificate Renewal FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-renewal#faqs?ts=markdown) * [What Is an X.509 Certificate? Definition, Standards, and Role](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate?ts=markdown) * [X.509 Certificates Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#page-anchor?ts=markdown) * [The Anatomy Of An X.509 Certificate](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#anatomy?ts=markdown) * [Important X.509 v3 Extensions](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#page-anchor?ts=markdown) * [The X.509 Trust Hierarchy And Chain](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#hierarchy?ts=markdown) * [Machine Identity And Management Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#identity?ts=markdown) * [Risks Of Poor Certificate Management](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#risks?ts=markdown) * [Zero Trust And X.509 Alignment](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#alignment?ts=markdown) * [How Does X.509 Support Zero Trust?](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#support?ts=markdown) * [X.509 Certificate FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-an-x509-certificate#page-anchor?ts=markdown) * [What Is Cert-Manager? Kubernetes Certificate Management Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager?ts=markdown) * [cert-manager Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#explained?ts=markdown) * [Core Components: Issuers and Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#core?ts=markdown) * [1. Issuers and ClusterIssuers](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#issuers?ts=markdown) * [2. Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#certificates?ts=markdown) * [How cert-manager Automates Machine Identity](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#how?ts=markdown) * [Common Compatible Cloud Platforms](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#common?ts=markdown) * [Zero Trust and Kubernetes Security Alignment](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#alignment?ts=markdown) * [Integrating cert-manager into DevSecOps Workflows](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#workflows?ts=markdown) * [Benefits for DevSecOps Teams](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#benefits?ts=markdown) * [cert-manager FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-cert-manager#faqs?ts=markdown) * [What Is a TLS Decryption? Methods, Risks \& Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption?ts=markdown) * [TLS Decryption Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#explain?ts=markdown) * [How TLS Decryption Works](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#how?ts=markdown) * [Methods of Decryption: Passive vs. Active](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#methods?ts=markdown) * [The Role of TLS Decryption in Zero Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#role?ts=markdown) * [Technical Challenges: TLS 1.3 and Performance](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#challenges?ts=markdown) * [Operational Best Practices and Privacy](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#operational?ts=markdown) * [TLS Decryption FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-decryption#faqs?ts=markdown) * [What Is a Multi-Domain SSL Certificate? SAN \& UC Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate?ts=markdown) * [Multi-Domain SSL Certificates Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#explained?ts=markdown) * [How Multi-Domain SSL Works: The Power of SAN](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#how?ts=markdown) * [Core Types of Multi-Domain Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#core?ts=markdown) * [Strategic Benefits for Modern Enterprises](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#staregic?ts=markdown) * [Security Risks and Lateral Movement Considerations](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#security?ts=markdown) * [Implementation and Lifecycle Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#best?ts=markdown) * [Multi-Domain SSL FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-domain-ssl-certificate#faqs?ts=markdown) * [TLS/SSL Offloading: Definition \& Decision Checklist](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading?ts=markdown) * [TLS/SSL Offloading Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#offloading?ts=markdown) * [SSL Termination vs. SSL Bridging](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#vs?ts=markdown) * [Key Differences in Workflow](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#key?ts=markdown) * [Unit 42 Perspective: Risks of Uninspected Traffic](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#unit42?ts=markdown) * [Benefits for Security and Infrastructure Teams](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#benefits?ts=markdown) * [CISO Decision Checklist: SSL Termination vs. SSL Bridging for Compliance](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#ciso?ts=markdown) * [Detailed CISO Decision Checklist](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#checklist?ts=markdown) * [Summary Recommendation for CISOs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#summary?ts=markdown) * [TLS/SSL Offloading FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-offloading#faqs?ts=markdown) * [What is Code Signing? Benefits, Risks \& Implementation](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing?ts=markdown) * [Code Signing Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#signing?ts=markdown) * [Critical Benefits for Enterprise Security](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#critical?ts=markdown) * [The Technical Mechanism: How Code Signing Works](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#mechanism?ts=markdown) * [The Necessity of Trusted Timestamping](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#timestamping?ts=markdown) * [Standard vs. EV Code Signing Certificates](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#vs?ts=markdown) * [Addressing Vulnerabilities in the Signing Process](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#page-anchor?ts=markdown) * [Code Signing FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing#faqs?ts=markdown) * What Is ACME Protocol? * [ACME Protocol Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#dora?ts=markdown) * [How The ACME Protocol Works](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#how?ts=markdown) * [ACME Across The Machine Identity Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#across?ts=markdown) * [ACME Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#challenges?ts=markdown) * [Why ACME Matters For Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#why?ts=markdown) * [Implementation Patterns](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#implementation?ts=markdown) * [Real World Evidence](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#world?ts=markdown) * [Where ACME Secrets Leak In Real Life](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#where?ts=markdown) * [ACME Protocol FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#faq?ts=markdown) * [What Is Certificate Pinning? Benefits, Risks \& Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning?ts=markdown) * [Certificate Pinning Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#certificate?ts=markdown) * [How Certificate Pinning Works](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#how?ts=markdown) * [Listiche: Key Stages of a Pinning Failure](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#key?ts=markdown) * [Types of Certificate Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#types?ts=markdown) * [Listiche: Static vs. Dynamic Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#static?ts=markdown) * [Why Pinning Is Essential for Zero Trust](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#why?ts=markdown) * [Certificate Pinning vs. Standard SSL/TLS](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#certificate?ts=markdown) * [Benefits of Certificate Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#benefits?ts=markdown) * [Risks and Limitations of Certificate Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#risks?ts=markdown) * [When to Use Certificate Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#when?ts=markdown) * [When to Avoid Certificate Pinning](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#when?ts=markdown) * [Certificate Pinning Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#certificate?ts=markdown) * [Certificate Pinning and Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#identity?ts=markdown) * [FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning#faqs?ts=markdown) * [What Is a TLS/SSL Port? Port 443 and HTTPS Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-port?ts=markdown) * [TLS/SSL Ports Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-port#explained?ts=markdown) * [Use Cases \& Real-World Examples](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-port#examples?ts=markdown) * [Secure vs. Unsecured Port Comparison](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-port#vs?ts=markdown) * [TLS/SSL Port FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-ssl-port#faqs?ts=markdown) * [TLS Certificate Risks: Vulnerabilities and Mitigation Strategies](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk?ts=markdown) * [TLS Certificate Risks Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#tls?ts=markdown) * [Primary Vulnerabilities in TLS Certificate Management](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#primary?ts=markdown) * [Advanced Threats to the Trust Ecosystem](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#advanced?ts=markdown) * [The Impact of AI and Emerging Technologies](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#impact?ts=markdown) * [Implementation Guide: Securing Your TLS Environment](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#implementation?ts=markdown) * [TLS Certificate Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#best?ts=markdown) * [TLS Certificate Risks FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk#faqs?ts=markdown) * [What Is a Certificate Authority?](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority?ts=markdown) * [Certificate Authorities Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#explained?ts=markdown) * [How a Certificate Authority Works](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#how?ts=markdown) * [What Is a Digital Certificate?](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#what?ts=markdown) * [Types of Digital Certificates Issued by CAs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#types?ts=markdown) * [Validation Levels: Understanding Trust Thresholds](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#validation?ts=markdown) * [Challenges in Modern Certificate Management](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#challenges?ts=markdown) * [Certificate Authority FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-authority#faqs?ts=markdown) * [What Is a Certificate Chain of Trust?](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust?ts=markdown) * [Certificate Chain of Trust Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#explained?ts=markdown) * [Structural Components of a Certificate Chain](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#structural?ts=markdown) * [How the Cryptographic Validation Process Works](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#how?ts=markdown) * [Common Weaknesses and Operational Pitfalls](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#common?ts=markdown) * [Advanced Strategies for Enterprise Chain Management](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#advanced?ts=markdown) * [Certificate Chain of Trust FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-certificate-chain-of-trust#faqs?ts=markdown) * [What Is Workload Identity? Securing Non-Human Identities](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity?ts=markdown) * [Workload Identity Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#workload?ts=markdown) * [The Core Components of Workload Identity Architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#core?ts=markdown) * [Workload Identity in the Zero Trust Framework](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#framework?ts=markdown) * [Disrupting the Attack Lifecycle with Workload Identity](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#disrupting?ts=markdown) * [Workload Identity and the AI Agent Security Challenge](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#challenge?ts=markdown) * [Workload Identity FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-workload-identity#faqs?ts=markdown) * [What Is a Non-Human Identity (NHI)? Machine Identity Security Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity?ts=markdown) * [Non-Human Identity Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#explained?ts=markdown) * [The Critical Distinction: Standing vs. Non-Standing Privileges](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#privileges?ts=markdown) * [Lateral Movement and Attacker Workflow](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#lateral?ts=markdown) * [Non-Human Identity and Zero Trust Alignment](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#alignment?ts=markdown) * [CIEM, IAM, and PAM Relationships in NHI Security](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#security?ts=markdown) * [Strategic Management and Testing of NHIs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#strategic?ts=markdown) * [Non-Human Identity FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity#faqs?ts=markdown) * [What Is a Machine Identity?](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity?ts=markdown) * [How Do Machine Identities Work?](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#how?ts=markdown) * [Machine Identity Management (MIM) vs. Human IAM](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#vs?ts=markdown) * [Architecture Components and Identity Types](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#types?ts=markdown) * [Secrets Management vs. Machine Identity Management](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#secrets?ts=markdown) * [Lateral Movement and Attacker Workflow](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#workflow?ts=markdown) * [Cloud Security Implications and CIEM](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#ciem?ts=markdown) * [Implementation Steps for Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#implementation?ts=markdown) * [Machine Identity FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity#faqs?ts=markdown) * [What is SPIFFE? Universal Workload Identity Framework Guide](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe?ts=markdown) * [SPIFFE Explained: Solving the Workload Identity Problem](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#explained?ts=markdown) * [Core Components of the SPIFFE Standard](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#core?ts=markdown) * [The SPIFFE Workload API](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#workload?ts=markdown) * [Why Traditional Secret Management Fails in Cloud-Native Environments](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#why?ts=markdown) * [The Problem of "Secret Zero"](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#problem?ts=markdown) * [Vulnerabilities of Static Credentials and Long-Lived Tokens](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#tokens?ts=markdown) * [IP-Based Security vs. Identity-Based Security](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#vs?ts=markdown) * [How SPIFFE Implementation Works: The Attestation Process](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#how?ts=markdown) * [The Role of SPIRE as the Reference Implementation](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#role?ts=markdown) * [Critical Use Cases for Enterprise Security](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#critical?ts=markdown) * [SPIFFE FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-spiffe#faqs?ts=markdown) * [What is Cloud Workload Security? Protection \& Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security?ts=markdown) * [Cloud Workload Security Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#cloud?ts=markdown) * [Why Cloud Workload Security Matters](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#why?ts=markdown) * [Key Components of a Cloud Workload Security Strategy](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#key?ts=markdown) * [Use Cases \& Real-World Examples](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#use-cases?ts=markdown) * [Cloud Workload Security Best Practices](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#practices?ts=markdown) * [Benefits of Strong Cloud Workload Security](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#practices?ts=markdown) * [Cloud Workload Security FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-cloud-workload-security#faqs?ts=markdown) # What Is the ACME Protocol? 4 min. read [Explore NGTS](https://www.paloaltonetworks.com/network-security/next-gen-trust-security?ts=markdown) Table of Contents * * [ACME Protocol Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#dora?ts=markdown) * [How The ACME Protocol Works](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#how?ts=markdown) * [ACME Across The Machine Identity Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#across?ts=markdown) * [ACME Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#challenges?ts=markdown) * [Why ACME Matters For Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#why?ts=markdown) * [Implementation Patterns](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#implementation?ts=markdown) * [Real World Evidence](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#world?ts=markdown) * [Where ACME Secrets Leak In Real Life](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#where?ts=markdown) * [ACME Protocol FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#faq?ts=markdown) 1. ACME Protocol Explained * * [ACME Protocol Explained](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#dora?ts=markdown) * [How The ACME Protocol Works](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#how?ts=markdown) * [ACME Across The Machine Identity Lifecycle](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#across?ts=markdown) * [ACME Challenges](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#challenges?ts=markdown) * [Why ACME Matters For Machine Identity Security](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#why?ts=markdown) * [Implementation Patterns](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#implementation?ts=markdown) * [Real World Evidence](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#world?ts=markdown) * [Where ACME Secrets Leak In Real Life](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#where?ts=markdown) * [ACME Protocol FAQs](https://www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol#faq?ts=markdown) The ACME (Automated Certificate Management Environment) protocol is a communications standard for automating the issuance, validation, and renewal of SSL/TLS certificates. As defined in RFC 8555, it eliminates manual administrative tasks by enabling machine-to-machine communication between a certificate management agent and a Certificate Authority (CA) to secure web traffic at scale. Key Points * **Certificate Automation:** ACME automates certificate issuance and renewal to reduce manual effort and prevent expired certificate outages. \* **Domain Validation:** ACME proves domain control via challenge-response protocols, typically via DNS or HTTP. \* **Standard Protocol:** RFC 8555 defines ACME and includes signed requests and replay protections. \* **Machine Identity Fit:** Certificates act as machine identities for workloads, services, and devices. \* **Security Boundary:** DNS control and ACME account key control determine how safe automation stays. \* **Operational Visibility:** Logging orders and challenge outcomes speeds troubleshooting and incident response. ## ACME Protocol Explained Certificates are [machine identities](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity?ts=markdown) that authenticate systems, establish trust, and encrypt traffic between services, users, and devices. When certificate counts climb into the hundreds or thousands, manual renewal breaks first, then outages hit at the worst possible time, during releases, peak traffic, or incident response. ACME standardizes certificate lifecycle actions, enabling systems to request, validate, renew, and revoke certificates on schedule without manual intervention. That reliability is a core [Identity security](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-security?ts=markdown) outcome because it protects authentication flows from sudden failures and reduces the need for risky workarounds, such as extending certificate lifetimes or reusing keys. The urgency behind ACME adoption is partly market-driven. The CA/Browser Forum has been steadily reducing maximum certificate lifetimes, from years to 90 days for many public CAs, with proposals to push further toward 47 days or even shorter. At these lifetimes, manual renewal isn't just inefficient; it's operationally impossible at scale. ACME adoption is increasingly a requirement rather than an optimization. ACME works best when you treat certificate automation as [identity governance](https://www.paloaltonetworks.com/cyberpedia/what-is-identity-governance-and-administration-iga?ts=markdown), not as a convenience feature. In practice, that means you control who can issue certificates, how domain validation happens, where keys are stored, and how events are logged and reviewed, just like any other Identity security control. **ACME Protocol Automation Loop Diagram** ![The ACME protocol automation loop, illustrating the request, challenge-response validation, and certificate issuance phases](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-acme-protocol/acme-protocol-automation-loop-diagram.webp "A clean, professional technical architectural diagram of the ACME Protocol. It shows a web server on the left labeled 'ACME Client' and a cloud icon on the right labeled 'Certificate Authority'. Arrows show a loop: 1. Request, 2. Challenge, 3. Validation, 4. Certificate Issuance.") \*\*Figure 1:\*\*The ACME protocol automation loop, illustrating the request, challenge-response validation, and certificate issuance phases. ## How The ACME Protocol Works The ACME protocol functions through a structured exchange of JSON messages over secure HTTPS connections. This process replaces the traditional, manual Certificate Signing Request (CSR) workflow with an automated agent-based model. ### The Role of the ACME Client The client is an agent installed on the web server or infrastructure requiring protection. It initiates requests for new certificates, handles cryptographic challenges, and monitors expiration dates. Because these agents function as highly privileged services, they are central to modern security strategies for [non-human identities](https://www.paloaltonetworks.com/cyberpedia/what-is-a-non-human-identity?ts=markdown). ### The Role of the ACME Server The server resides with the Certificate Authority (CA), such as Let's Encrypt or a private enterprise CA. It manages the account registrations, issues challenges to the client, and finalizes the issuance once the client proves domain control. ### ACME Validation Methods: Challenges and Tradeoffs To prove a requester owns a domain, the ACME protocol uses specific "challenges." Each method has distinct security implications for enterprise infrastructure. * **HTTP-01 Challenge:** The client places a specific token at a predetermined URL on the web server. The CA verifies this token via a standard HTTP request. * **DNS-01 Challenge:** The client creates a TXT record in the domain's DNS settings. This is the only method that supports wildcard certificates. * **TLS-ALPN-01 Challenge:** Validation occurs over TLS port 443 using a specific protocol identifier. This is ideal for environments where port 80 is restricted. ### Real-World Benefits of Certificate Automation Manual certificate management is error-prone and leads to significant operational risk. ACME provides an extensible framework that ensures identity lifecycle management remains consistent across sprawling cloud environments. By automating the "monitor-renew-install" loop, organizations prevent expired certificates from causing application downtime. ACME supports CA agility by standardizing the issuance interface, reducing the work required to switch certificate authorities. However, achieving clean CA rotation in practice also requires abstracting CA-specific configurations, such as endpoint URLs, account registrations, and differences in challenge behavior, behind a management layer. ## ACME Across The Machine Identity Lifecycle This mapping frames ACME as a lifecycle control for machine identity programs. ### Issue ACME issues certificates when a new service or endpoint comes online. You control risk by restricting who can initiate orders and who can complete challenges. ### Deploy After issuance, systems deploy the certificate and private key to the appropriate runtime component, such as an ingress, proxy, or service mesh component. Poor deployment controls cause private key sprawl, and automation amplifies that sprawl. ### Rotate Rotation is ACME's primary value. Frequent renewal reduces long-lived credential exposure, but only if you alert quickly to failures and recover cleanly. ### Revoke Revocation matters when keys leak or ownership changes. ACME supports revocation functions, but two problems limit its effectiveness: 1. Many teams do not integrate revocation into incident response workflows, so compromised certificates remain active. 2. Revocation checking itself is unreliable across the ecosystem because many clients implement OCSP and CRL checks as soft-fail or skip them entirely. This is a primary reason the industry has moved toward shorter certificate lifetimes as the practical mitigation: if a certificate expires in hours or days, the window of exposure from a compromised certificate shrinks even without reliable revocation. ### Audit ACME creates a trail of orders, validations, and renewals. Centralizing these logs gives you accountability for who issued what, when, and why, which helps both investigations and compliance. ## ACME Challenges ACME uses challenge-response to prove control of a domain. Teams often choose DNS-based validation for wildcard certificates and locked-down environments, and they choose HTTP-based validation for simpler public endpoints. If you validate through DNS, DNS access becomes your issuance perimeter. Treat DNS API tokens like high-value credentials because they effectively control who can obtain certificates. ## Why ACME Matters For Machine Identity Security [Machine identity security](https://www.paloaltonetworks.com/cyberpedia/what-is-machine-identity-security-mis?ts=markdown) focuses on discovering, governing, and protecting non-human credentials, such as certificates, keys, and tokens. ACME helps teams keep certificate lifecycles aligned with cloud speed, especially when workloads change quickly, and services rely on TLS for trust. ACME also reduces the temptation to stretch certificate lifetimes just to avoid renewals. Shorter lifetimes can reduce blast radius, but only if you can rotate reliably. ## Implementation Patterns ACME appears in a few recurring architectures. Choose the pattern that matches where you terminate TLS and who owns renewal operations. ### Pattern 1: Ingress-Based Issuance A central ingress controller requests and renews certificates for public endpoints, then serves TLS at the edge. This pattern keeps automation in one place and reduces key sprawl, but it creates a shared failure domain if teams overload one issuer pipeline. **Best Fit:** Internet-facing apps with standardized ingress \*\*Watch Out:\*\*A single failed renewal pipeline can impact many hostnames ### Pattern 2: Service Mesh and mTLS Rotation Workloads use a service mesh, a sidecar, or a workload identity framework such as SPIFFE/SPIRE to issue and rotate short-lived certificates for service-to-service authentication. In many implementations, workload identity platforms handle issuance directly through platform-level attestation rather than domain-based ACME challenges, making this pattern architecturally distinct from ACME even though the outcome (short-lived mTLS certificates) is similar. Teams should evaluate whether ACME or a workload identity framework is the right issuance model for east-west traffic. This pattern supports short-lived identities and continuous rotation, which aligns with machine identity programs. **Best Fit:** Microservices, east-west traffic, mTLS at scale **Watch Out:** Teams bypass mesh controls during outages, then identity drift follows ### Pattern 3: Internal CA With ACME As The Front Door An internal certificate authority issues certificates, and ACME provides the standard automation interface for teams and platforms. This pattern keeps issuance within your trust boundary and supports consistent policy enforcement, but it requires strong DNS and key governance. **Best Fit:** Enterprise internal services and private domains **Watch Out:** DNS API token sprawl and weak ACME account key storage **Which Pattern Should You Choose?** | Environment Need | Pattern | Why It Fits | | Centralized edge TLS | Ingress-Based Issuance | You concentrate renewal and reduce the private key spread | | Service to service identity | Service Mesh and mTLS Rotation | You rotate frequently and enforce a consistent workload identity | | Private trust boundary | Internal CA With ACME As The Front Door | You keep issuing internally and standardize automation | |-----------------------------|-----------------------------------------|------------------------------------------------------------------| ## Real World Evidence ### Threat Model 1: ACME Client Compromise (Automated Certificate Abuse) [Unit 42 reporting](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report?ts=markdown) continues to show that identity-driven access is a primary driver of attacker success. As organizations scale ACME to manage certificates at volume, the ACME client environment (the agent, its service account, and its secrets) becomes a high-value target. * **Automated speed, amplified:** Attackers can operationalize newly disclosed weaknesses quickly. If an adversary compromises an ACME client---or gains access to the client's credentials---they can automate certificate requests and obtain fraudulent certificates that allow malicious services to impersonate legitimate ones. * **What's actually at risk:** In this scenario, the attacker's leverage comes from control of the ACME client or its keys (e.g., API tokens, account keys, CI/CD secrets, workload identity). * **Primary defensive investments:** Focus on strong, key-based storage and access controls---HSM/KMS-protected where possible, least-privileged access for ACME-related identities, secret rotation, locked-down CI/CD runners, and tight audit trails for certificate issuance actions. ### Threat Model 2: DNS or Domain Control Compromise (Abusing Legitimate ACME Workflows) Separate from client compromise is a second, equally common pattern: attackers never touch the ACME client. Instead, they compromise the domain's control plane---most often DNS---then use a perfectly legitimate ACME workflow to obtain certificates. [Unit 42 has documented incidents](https://unit42.paloaltonetworks.com/detect-dns-hijacking-passive-dns/) where adversaries abused Let's Encrypt during DNS hijacking to issue certificates that made malicious infrastructure appear trustworthy. This is an example of infrastructure compromise, not ACME client compromise. * **Why this matters for ACME programs:** DNS often gates certificate issuance (especially for DNS-01). If an attacker takes over DNS, they can satisfy validation challenges and obtain certificates that blend into normal traffic patterns---even when the ACME client remains secure. * **Primary defensive investments:** Prioritize DNS security controls (lock down registrar/DNS accounts, MFA, least privilege, change control), plus Certificate Transparency monitoring to detect unexpected issuance, and CAA records to restrict which CAs are allowed to issue for your domains. **Bottom line:** These are two distinct paths to bad certificates---client/key compromise vs. DNS/domain control compromise, and they require different security budgets. ## Where ACME Secrets Leak In Real Life Use this as a quick checklist during onboarding, troubleshooting, and incident review. * **Account Keys:** Teams store ACME account keys in repos or shared admin boxes, then forget they exist. If attackers steal the key, they can attempt unauthorized certificate actions. * **DNS Tokens:** DNS automation uses provider tokens that often carry broad permissions. If those tokens leak, attackers can satisfy DNS challenges and pivot into certificate issuance. * **Private Keys:** Automation pipelines write private keys to disk in logs or temporary folders. That behavior turns certificate automation into key sprawl. * **Ingress Configs:** Engineers copy validation configs across environments and misroute challenge paths. Misroutes cause silent failures and can expose validation endpoints. **ACME Technical Decision Table** | Decision Area | Recommended Choice | Why It Matters | | Validation Method | DNS validation for wildcard and restricted endpoints | DNS control becomes the security boundary for issuance | | Account Key Storage | Vault or HSM-backed storage with tight access | ACME actions rely on signed requests tied to account keys | | Renewal Window | Renew early and alert on any failure | You prevent outages and spot broken automation quickly | | DNS Access | Least privilege tokens plus rotation and approvals | A DNS compromise can enable unauthorized validation and issuance | | Key Handling | Separate issuance from key storage and deploy | You reduce private key sprawl across systems | | Logging | Central logging of orders and challenge results | You improve incident response and auditability | |---------------------|------------------------------------------------------|------------------------------------------------------------------| ## ACME Protocol FAQs ### What Is The ACME Protocol Used For ACME automates the request, validation, issuance, renewal, and revocation of TLS certificates with a certificate authority. It enables systems to manage certificates via a standard protocol rather than manual ticket workflows. ### How Does ACME Verify Domain Ownership ACME verifies domain control via challenge-response. The certificate authority issues a challenge, and the client proves control by placing a token on the domain, typically via a DNS record or an HTTP file. ### What Are The Security Risks Of ACME ACME shifts risk toward issuance controls. If attackers steal the ACME account key or take over DNS control, they can issue valid certificates, making malicious infrastructure appear legitimate. ### ACME Vs SCEP Vs EST: When Should You Use ACME? Use ACME when you need automated web PKI issuance tied to domain control, especially for internet-facing TLS and service endpoints. For enterprise device enrollment against private CAs, EST provides stronger mutual authentication and is the modern standard. SCEP serves the same enrollment use case but has legacy security limitations and should be reserved for environments that require older device support. Your trust model, enrollment flow, and device ecosystem should inform the choice. ### Is ACME limited to Let's Encrypt? No. While Let's Encrypt pioneered the protocol, ACME is an open IETF standard (RFC 8555). Many commercial and private Certificate Authorities now support ACME for enterprise certificate automation. ### What are the security risks of the DNS-01 challenge? The DNS-01 challenge requires the ACME client to have write-access to your DNS records via an API. If these API credentials are stolen, an attacker can redirect traffic or issue certificates for any subdomain, bypassing traditional perimeter defenses. ### Does ACME handle certificate installation automatically? The protocol itself handles issuance and revocation. However, many ACME clients (like Certbot) include "authenticators" and "installers" that can automatically update configuration files for Nginx, Apache, or other services. Recommended for you [Explore TLS Certificate Lifecycle See how automated certificate issuance fits into lifecycle management.](https://www.paloaltonetworks.com/cyberpedia/what-is-tls-certificate-lifecycle?ts=markdown) [Read the Solution Brief Learn how organizations can prevent certificate-driven outages across network infrastructure.](https://www.paloaltonetworks.com/resources/techbriefs/prevent-certificate-driven-outages?ts=markdown) [Read the Data Sheet See how NGTS brings certificate lifecycle management and modern PKI into the network control plane.](https://www.paloaltonetworks.com/resources/datasheets/next-generation-trust-security?ts=markdown) [Learn about the Cryptogrpahic Reset Discover how to automate trust and enforce quantum-safe protection natively through your network.](https://www.paloaltonetworks.com/network-security/cryptographic-reset?ts=markdown) ![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20Is%20ACME%20Protocol%3F&body=Learn%20what%20the%20ACME%20protocol%20is%2C%20how%20it%20automates%20certificate%20issuance%20and%20renewal%2C%20common%20challenges%2C%20security%20risks%2C%20and%20enterprise%20best%20practices.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/what-is-acme-protocol) Back to Top [Previous](https://www.paloaltonetworks.com/cyberpedia/what-is-code-signing?ts=markdown) What is Code Signing? Benefits, Risks \& Implementation [Next](https://www.paloaltonetworks.com/cyberpedia/what-is-certificate-pinning?ts=markdown) What Is Certificate Pinning? Benefits, Risks \& Best Practices {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * Observability * [Cortex XCOR](https://www.paloaltonetworks.com/cortex/xcor?ts=markdown) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/prepare-for-emerging-risks/continuous-frontier-ai-defense?ts=markdown) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses?ts=markdown) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy?ts=markdown) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence?ts=markdown) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center-subscribe.html) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language