diff --git a/cmd/web_acme.go b/cmd/web_acme.go
index 6e40aef2924..857114ff902 100644
--- a/cmd/web_acme.go
+++ b/cmd/web_acme.go
@@ -83,6 +83,7 @@ func runACME(listenAddr string, m http.Handler) error {
 		TrustedRoots:            certPool,
 		Email:                   setting.AcmeEmail,
 		Agreed:                  setting.AcmeTOS,
+		Profile:                 setting.AcmeProfile,
 		DisableHTTPChallenge:    !enableHTTPChallenge,
 		DisableTLSALPNChallenge: !enableTLSALPNChallenge,
 		ListenHost:              setting.HTTPAddr,
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index ab5ddb6beff..3b3a17009cd 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -261,6 +261,9 @@
 ;; Can be left blank to initialize at first run and use the cached value
 ;ACME_EMAIL =
 ;;
+;; ACME profile to request from the CA (e.g. "shortlived" for raw-IP certificates)
+;ACME_PROFILE =
+;;
 ;; ACME live directory (not to be confused with ACME directory URL: ACME_URL)
 ;; (Refer to caddy's ACME manager https://github.com/caddyserver/certmagic)
 ;ACME_DIRECTORY = https
diff --git a/modules/setting/server.go b/modules/setting/server.go
index 6d0683655a2..289db6a044c 100644
--- a/modules/setting/server.go
+++ b/modules/setting/server.go
@@ -101,6 +101,7 @@ var (
 	AcmeLiveDirectory          string
 	AcmeEmail                  string
 	AcmeURL                    string
+	AcmeProfile                string
 	AcmeCARoot                 string
 	SSLMinimumVersion          string
 	SSLMaximumVersion          string
@@ -171,6 +172,7 @@ func loadServerFrom(rootCfg ConfigProvider) {
 		Protocol = HTTPS
 		if EnableAcme {
 			AcmeURL = sec.Key("ACME_URL").MustString("")
+			AcmeProfile = sec.Key("ACME_PROFILE").MustString("")
 			AcmeCARoot = sec.Key("ACME_CA_ROOT").MustString("")
 
 			if sec.HasKey("ACME_ACCEPTTOS") {