diff --git a/backend/src/ee/routes/v1/pki-acme-router.ts b/backend/src/ee/routes/v1/pki-acme-router.ts
index 329a381e3..8b6c7c817 100644
--- a/backend/src/ee/routes/v1/pki-acme-router.ts
+++ b/backend/src/ee/routes/v1/pki-acme-router.ts
@@ -10,6 +10,7 @@ import {
   CreateAcmeOrderBodySchema,
   DeactivateAcmeAccountBodySchema,
   DeactivateAcmeAccountResponseSchema,
+  DownloadAcmeCertificateBodySchema,
   FinalizeAcmeOrderBodySchema,
   GetAcmeAuthorizationResponseSchema,
   GetAcmeDirectoryResponseSchema,
@@ -372,10 +373,12 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, res) => {
-      const { profileId, accountId } = await validateExistingAccount({
-        req,
-        schema: FinalizeAcmeOrderBodySchema
+      const { profileId, accountId, payload } = await validateExistingAccount({
+        req
       });
+      if (payload !== "") {
+        throw new AcmeMalformedError({ detail: "Payload should be empty" });
+      }
       return sendAcmeResponse(
         res,
         profileId,
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 84f28c7ac..134645fa5 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -603,11 +603,12 @@ export const pkiAcmeServiceFactory = ({
     if (!order) {
       throw new NotFoundError({ message: "ACME order not found" });
     }
-    // FIXME: Implement ACME certificate download
-    // Return the certificate in PEM format
+    if (order.status !== AcmeOrderStatus.Valid) {
+      throw new AcmeOrderNotReadyError({ message: "ACME order is not valid" });
+    }
     return {
       status: 200,
-      body: "FIXME-certificate-pem",
+      body: order.certificateChain! + "\n" + order.certificate!,
       headers: {
         Location: buildUrl(profileId, `/orders/${orderId}/certificate`),
         Link: `<${buildUrl(profileId, "/directory")}>;rel="index"`