The flow uses JWS-signed HTTPS requests from an account key: create an account, submit an order listing identifiers, complete one challenge per authorization (http-01, dns-01 or tls-alpn-01), send a CSR to the order's finalize URL and download the certificate chain. Each request carries a fresh Replay-Nonce value and is bound to its URL in the protected header.
Challenge responses are derived from a key authorization, token ‖ "." ‖ base64url(JWK thumbprint of the account key) (RFC 8555 §8.1), so another account cannot reuse them. Extensions: tls-alpn-01 (RFC 8737), IP identifiers (RFC 8738), ACME Renewal Information (RFC 9773) and certificate profiles such as Let's Encrypt's classic, tlsserver and shortlived.
Clients include Certbot, lego, acme.sh, Caddy and cert-manager; CAs offering ACME include Let's Encrypt, ZeroSSL, Google Trust Services, Sectigo, DigiCert and SSL.com, and private CAs such as step-ca and Vault speak it too. With lifetimes heading to 47 days, ACME is effectively mandatory for public TLS.