StreamSec Tools 4.x includes a clean-room ACME client (RFC 8555) for Embarcadero Delphi ^TM — the certificate-automation protocol behind Let's Encrypt and a growing number of public and private certificate authorities. First added in version 4.1.1, it turns certificate deployment from a recurring manual chore into something your application does for itself: request, validate, install, renew — unattended, with the server still serving.

MANAGED MODE: ONE CALL

Point TsmAcmeClient at your live TLS server and call ObtainCertificate. The component registers the account, places the order, answers the tls-alpn-01 challenge on the running server without interrupting normal traffic (RFC 8737), downloads the issued chain and installs it with a hot swap — established connections keep their session, new connections get the new certificate. The live certificate and key are kept in a PFX that is replaced atomically and reloaded at the next start, so a crash mid-renewal cannot leave the server without an identity.

UNATTENDED RENEWAL

• TsmAcmeRenewalManager schedules renewals on its own worker thread, so it works in Windows services and console servers, not only GUI applications
• ACME Renewal Information (ARI, RFC 9773) is honoured when the CA offers it — a CA asking for early renewal, for example ahead of a revocation, is acted on automatically; otherwise renewal is scheduled at a configurable fraction of the validity period
• Failures are classified before they are retried: transient errors back off exponentially while the old certificate keeps serving; permanent errors (a rejected identifier, a bad CSR) stop retrying and raise an event instead of burning the CA's rate limits
• Serving both an RSA and an ECDSA certificate on one server? Two clients coordinate their challenges automatically

ALL THREE CHALLENGE TYPES

• tls-alpn-01 — answered on your live TLS server in managed mode, or by your own handler through an event
• http-01 — through an event, for deployments that validate on port 80
• dns-01 — through an event, and the route to wildcard certificates

Accounts support External Account Binding (EAB) for the CAs that require it.

BUILT ON THE LIBRARY'S OWN PRIMITIVES

The JOSE layer underneath (JWS signatures, JWK thumbprints), the JSON codec, the CSR generator and the HTTPS transport are all StreamSec units — no OpenSSL, no bundled binaries, and account keys are ordinary StreamSec key components (RSA, ECDSA or EdDSA). The protocol flow is proven end-to-end against an independent ACME server implementation, and the client is exercised against the live Let's Encrypt API. A step-by-step guide to requesting a certificate from Let's Encrypt ships with the library, and every property involved carries a matching comment in its unit.