Getting started

This section outlines the minimum steps required to obtain certificates using Certificates as a Service (CaaS), assuming that the ACME client is operated by your customer.

The following illustration depicts this workflow, which is explained in more detail in the sections below.

How to start getting certificates

For more information on the topics covered in this section, see Related documentation.

Prerequisites

  • A Sectigo Reseller account with CaaS enabled

  • cURL

  • An ACME client that supports External Account Binding (EAB) and conforms to the RFC 8555 standard

  • A domain name

  • A DNS provider for the domain name that is supported by the ACME client

Step one: Create an ACME account for your customer

Call the PREREGISTER action API to create the customer’s ACME account.

Variable Name Type Max. Length Description

loginName

string

64 chars

Your account username.

This value is case sensitive.

loginPassword

string

128 chars

Your account password.

This value is case sensitive.

action

string

30 chars

The action to be taken.

In this case, the value is: PREREGISTER.

serverUrl

string

32 chars

The sectigo ACME server to be used.

Available ACME server URLs can be fetched using LISTSERVERS action.

Sample request

curl --location --request POST 'https://secure.trust-provider.com/products/!ACMEAdmin' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'loginName=loginName' \
--data-urlencode 'loginPassword=loginPassword' \
--data-urlencode 'action=PREREGISTER' \
--data-urlencode 'serverURL=https://acme.sectigo.com/v2/DV'

Success response

{
  "Accounts": [
    {
      "acmeAccountID": "ABc_123xYZ456",
      "accountStatus": "pending",
      "eabMACKeyb64url": "ghM4321abc_D8765xyZ",
      "eabMACIDb64url": "ZyX321_abc654DeF1"
    }
  ]
}

Step two: Add a domain to the subscription for the created ACME account

Call the ADDDOMAIN action API to link a Fully Qualified Domain Name (FQDN) or wildcard domain to the customer’s ACME account.

Variable Name Type Max. Length Description

loginName

string

64 chars

Your account username.

This value is case sensitive.

loginPassword

string

128 chars

Your account password.

This value is case sensitive.

action

string

30 chars

The action to be taken.

In this case, the value is: ADDDOMAIN.

acmeAccountID

string

32 chars

Your Base64 url encoded ACME account ID.

domainName

string

255 chars

Your FQDN or wildcard domain name.

quoteOnly

string

1 char

Indicates whether to return a quote or perform the actual action.

The possible values are:

  • N — (Default) Performs the actual ADDDOMAIN action.

  • Y — Returns a quote for the requested action, valid at the time of request, but does not perform any action.

addAssociatedFQDN

string

1 char

Indicates whether to include an FQDN associated with the domain being added.

The possible values are:

  • N — (Default) Adds only the specified domain name, in which case a check is performed to determine whether it is eligible to be added for free.

  • Y — Also adds the domain name allowed for free based on the domain type being added.

    See Domain Details for more details.
The acmeAccountID should be set to the acmeAccountID value that you received in the response from Step one when pre-registering this ACME account.

Sample request

curl --location --request POST 'https://secure.trust-provider.com/products/!ACMEAdmin' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'loginName=loginName' \
--data-urlencode 'loginPassword=loginPassword' \
--data-urlencode 'action=ADDDOMAIN' \
--data-urlencode 'acmeAccountID=ABc_123xYZ456' \
--data-urlencode 'domainName=domain.com'

Success responses

Success response
{
    "success": true,
    "orderNumber": 123456789,
    "cost": 200.00,
    // displayed price is for sample purposes only
    "currency": "USD",
    "domains": [
        {
            "domainName": "domain.com"
        }
    ]
}
Success response with quoteOnly set to Y
{
    "success": true,
    "cost": 200.00,
    // displayed price is for sample purposes only
    "currency": "USD",
    "domains": [
        {
            "domainName": "domain.com"
        }
    ]
}

Repeat this step to add additional domains.

Starting a subscription is not required to register an ACME account (Step four). However, a subscription is necessary to request a certificate (Step five). Since some ACME clients allow both account registration and certificate requests in a single command, we recommend completing both steps beforehand.

Step three: Provide your customer with ACME server URL and EAB details

Provide your customer with the ACME server URL and EAB credentials that you received in Step one.

Step four: Customer registers an ACME account

The customer uses their EAB credentials to register an ACME account with the Sectigo ACME server. This step completes the creation of the ACME account, binding it to your Sectigo Partner account.

The exact command can be found in the ACME client’s vendor documentation.

Step five: Customer requests a certificate

The customer requests a certificate with the Sectigo ACME server.

The exact command can be found in the ACME client’s vendor documentation.

Once the command is run, the following process is handled automatically through communication between the ACME client and the ACME server.

  1. The ACME client sends a certificate request to Sectigo’s ACME server.

    1. Wildcard, single-domain, and multi-domain certificates are available.

    2. All required domain names must be added to the subscription before enrollment and explicitly included in the certificate request.

  2. Domain ownership is verified through Domain Control Validation (DCV) using the DNS-01 or HTTP-01 methods.

  3. Once validation is complete, the ACME client submits a Certificate Signing Request (CSR).

  4. The issued certificate is downloaded.

Some ACME clients also offer built-in functionality to automatically install the certificate on the server.

Step six: Ensure automatic renewal is set up

Most ACME clients support pre-configured automatic renewal mechanisms. To ensure certificates are renewed automatically and to prevent expiration, review your ACME client’s automatic renewal mechanisms to determine if you need to manually configure a cron job or scheduled task to run the renewal process at regular intervals. Exact instructions for setting up automatic renewal can be found in the ACME client’s vendor documentation.

Your choice of ACME client depends primarily on your operating system, server environment, and required features. Below is a list of the most commonly used ACME clients by our customers.

Related documentation