Subscription overview

Subscriptions are available in 1, 2, and 3-year terms.

The subscription term needs to be provided during ACME account pre-registration. This term determines the subscription expiry date beginning when the subscription is initiated, not at the time of pre-registration.

Only one active subscription can exist at a time per external account binding (EAB) credentials. Additionally, domains are available to any ACME account that shares the same EAB credentials.

A certificate can only be issued within the subscription validity period. However, the certificate validity period will not be limited by the subscription expiry date.

We recommend extending the subscription before its expiry to ensure that when the ACME client requests a new certificate, it can be issued without interruption.

Subscription models

CaaS supports two subscription models:

  • Standalone domain model — Domains are billed individually when added to the subscription.

  • Bundle-based model — Domain capacity is purchased in predefined bundles, and domains can be added at any time throughout the subscription validity period without additional charges as long as capacity is available.

A subscription can use only one model. The selected model is defined at the time the subscription is initiated and remains unchanged for its entire lifecycle (per EAB credentials).

Standalone domain subscription

In the standalone domain model, purchasing domains and adding domains to the subscription are performed through the same action.

Domain inventory therefore represents both:

  • Domains currently active in the subscription.

  • Domains that have been purchased through incremental domain additions.

Billing occurs when a domain is added to the subscription or when the subscription is extended.

Domain pricing depends on the domain type:

  • Fully qualified domain name (FQDN)

  • Wildcard domain

Bundle-based subscriptions

In the bundle-based model, domain capacity is purchased upfront in predefined bundles and tracked in a Wallet.

The Wallet represents the total number of domain slots purchased through bundles and available for use within the subscription.

A domain slot represents the capacity for one domain within the subscription.

Domain inventory represents domains currently active in the subscription.

Billing and domain usage follow this model:

  • Billing occurs when purchasing bundles or extending the subscription.

  • Bundle pricing is applied per bundle, not per domain.

Bundles are available separately for fully qualified domain names (FQDNs) and wildcard domains.

Each domain added to the domain inventory:

  • Consumes one slot from the Wallet.

  • Does not incur additional charges.

Available slots determine whether additional domains can be added.

If no domain slots are available, additional bundles must be purchased before adding new domains.

Starting and maintaining subscriptions

The subscription model is determined by the first action performed for the subscription. If a bundle is added before any domain is added, the subscription uses the bundle-based model. Otherwise, the subscription uses the standalone domain model. If a domain is added before any bundle is added, the subscription uses the standalone domain model.

The subscription term specified in the PREREGISTER request is automatically applied when the subscription is initiated under the associated EAB credentials.

Standalone domain subscription model

A subscription begins when you add your first domain to the ACME account (and to all ACME accounts that share the same EAB details) and fees for your new subscription are immediately deducted from your Sectigo Reseller account. If a 2-year subscription is selected during ACME account pre-registration, the subscription expiration date is calculated as 730 days from the next calendar day after the first domain is added.

Adding additional domains to your subscription does not affect the term of your subscription. These new domains inherit the existing subscription’s expiration date and are subject to pro-rated charges based on the number of full days remaining before subscription expiration.

For more information, see Add a domain.

You may need to remove a domain from your subscription if it is no longer required or was added by mistake. The removal process affects the associated domain in your subscription that was added free of charge.

The REMOVEDOMAIN action removes a specified Fully Qualified Domain Name (FQDN) or wildcard domain from your subscription. You can remove a domain from your subscription at any time during the subscription validity period or grace period.

Removing a domain name within 30 days of adding it will result in an automatic full refund of the order under which it was added. Once the domain is removed, certificates can no longer be requested for the domain through associated ACME accounts. For more information, see Remove a domain.

Bundle-based subscription model

A subscription begins when you add your first bundle to the ACME account (and to all ACME accounts that share the same EAB details) and fees for your new subscription are immediately deducted from your Sectigo Reseller account. If a 2-year subscription is selected during ACME account pre-registration, the subscription expiration date is calculated as 730 days from the next calendar day after the first bundle is added.

Domains can then be added to the inventory within the Wallet capacity to start getting certificates for them. In this model, adding a domain never incurs charges (unlike the standalone domain model).

Adding additional bundle(s):

  • Expands the available domain capacity (Wallet).

  • Is subject to pro-rated charges based on the number of full days remaining before subscription expiration.

  • Does not affect the subscription term.

For more information, see Add a bundle and Add a domain.

A domain can be removed at any time as long as no certificate has been issued for it.

  • In this case, the domain slot is returned to the Wallet and can be used for another domain.

  • This allows correction of errors (such as typos or incorrect domain selection).

  • The removal process affects the associated domain in your subscription that was added free of charge.

Once a certificate has been issued for a domain, the domain becomes part of the subscription coverage for the purchased subscription term and can be removed during subscription extension window starting 30 days before subscription expiry and ending 30 days after subscription expiry. The REMOVEDOMAIN action removes a specified Fully Qualified Domain Name (FQDN) or wildcard domain from your subscription.

Once the domain is removed, certificates can no longer be requested for the domain through associated ACME accounts. For more information, see Remove a domain.

Extending subscriptions

Depending on the subscription type, the subscription must have at least one associated domain or bundle to be eligible for extension. Extensions can only be initiated within the extension window (grace period).

Extending a subscription used by ACME accounts that share particular EAB details adds the specified number of additional years to the subscription period for all domains associated with the current subscription iteration, as indicated in your request.

The maximum subscription term is 3 years.

Before extending a subscription, any domain names that you do not want to renew should be removed.

When extending a subscription, any previously paid domain will continue to be charged, while any domain that was granted for free will continue to be free.

When an extension is completed, the subscription’s new expiry date will be calculated for both models as follows:

New Subscription Expiry Date = Existing Subscription Expiry Date + Specified Duration

Standalone domain model

The cost for 1, 2, or 3 year subscription, including each active domain, is immediately deducted from your Sectigo Reseller account.

Sample extension scenario

In the following scenario, prices are hypothetical and are used for illustrative purposes only:

  • You have two Fully-Qualified Domain Names (FQDNs) that are part of your active subscription.

  • ACME DV Domain is priced at $365 per year.

  • Subscription Expiry Timestamp is 28/08/2025 23:59:59 for both domains.

  • There are 5 days remaining until the subscription’s expiration.

After your subscription is extended:

  • The Subscription Expiry Timestamp is updated to 28/08/2026 23:59:59 for both domains.

  • Your account is charged $730 ($365 x 2 FQDNs).

  • There are 370 days remaining until the subscription’s expiration.

    Adding a new domain immediately after this will incur a pro-rated charge of $370 ($1 per day for 370 days) until the subscription’s expiration.

Bundle-based domain model

A subscription must have at least one associated bundle to be eligible for extension.

From a billing perspective, the number of domains in the inventory does not matter when extending the subscription, unless domain capacity reduction is performed.

The cost for 1, 2, or 3 year subscription is immediately deducted from your Sectigo Reseller account.

  • By default, billing preserves the structure of incremental bundle additions. For example, if a 3-domain bundle was added first and then another 3-domain bundle, the cost of the 2 × 3-domain bundles is billed in this case.

  • You may request a different bundle structure. For example, if your Wallet contains 6 domains (for example, from two 3‑domain bundles), you may request to bill them as 1 × 5‑domain bundle and 1 × 1‑domain bundle.

  • However, any such restructuring must use the supported bundle sizes:

    • fqdn (FQDN) bundles: 1, 3, 5, 10 domains per bundle

    • wildcard bundles: 1, 3, 5 domains per bundle

Subscription extension supports both capacity reduction and domain replacement (if needed).

Replacement domains are not charged for the remaining time of the current subscription term. However, certificates can be issued for them immediately, creating an incentive to extend the subscription earlier.
Capacity increase can be achieved by adding new bundles.
Sample extension scenario

In the following scenario, prices are hypothetical and are used for illustrative purposes only:

  • You have bought two DV bundles with 3 Fully-Qualified Domain Names (FQDNs) each for one of your subscriptions and would like to extend it for another year.

  • 3-FQDN DV Bundle is priced at $500 per year.

  • Subscription Expiry Timestamp is 28/08/2025 23:59:59.

  • There are 5 days remaining until the subscription’s expiration.

After your subscription is extended:

  • The Subscription Expiry Timestamp is updated to 28/08/2026 23:59:59 effective for all existing and future domains in this subscription.

  • Your account is charged $1000 ($500 x 2*3-FQDN DV Bundle).

  • There are 370 days remaining until the subscription’s expiration.

    Adding a new bundle immediately after this will incur a pro-rated charge of about $507 (roughly $1.37 per day for 370 days) until the subscription’s expiration.

The following applies to both standalone and bundle-based subscriptions:

If a subscription is not extended before its expiration, or within the applicable grace period, all domains from the expired subscription are also considered expired. These domains must be re-added to a new subscription in order for associated ACME clients to continue requesting certificates for them. If you start a new subscription without re-adding all expired domains, they remain visible in reporting but are not included in the subscription and do not incur charges. For more information, see Extend subscriptions.

Organization pre-validations management

To enable OV/EV SSL or eIDAS QWAC‑Legal issuance via ACME, organization pre-validation is required. Organization pre-validation ensures that the organization’s details are validated and included in the certificates for the domains linked to the organization during the pre-validation’s validity period.

For OV and QWAC subscriptions, the domain can only be added if it is linked to a valid organization pre-validation.

If you already have an active organization pre-validation used outside of CaaS, you can also use it within CaaS.

We strongly recommend ensuring that the organization pre-validation has at least 30 days remaining before its expiration to avoid disruptions in certificate issuance. This ensures that automated processes within CaaS, such as organization pre-validation renewal, can continue seamlessly without requiring manual intervention.

To ensure uninterrupted issuance of certificates during the subscription period, organization pre-validations must be renewed and re-assigned to domain names prior to expiration. CaaS handles this process automatically.

  • Auto-renewal: Automation streamlines the renewal process by eliminating your need to track expiration dates, place orders, or re-assign pre-validations. The system autonomously maintains the validity of organization pre-validations, ensuring seamless operation during the subscription period and throughout the post-expiration grace period. This approach reduces administrative overhead and ensures continuous validation of organizations without manual intervention.

Key benefits of auto-renewal include:

  • Continuous validation of organizations without manual intervention.

  • Seamless OV/EV SSL and/or QWAC-Legal certificate issuance for domains linked to validated organizations.

  • Reduced administrative overhead for managing organization validations.

Auto-renewal functionality is applied to all organizations used for the active subscription and remains operational for the duration of the subscription’s validity and grace period. The auto-renewal of organization pre-validations is configured at the account level, enforcing a uniform renewal strategy for all pre-validations associated with the Sectigo Partner account that are used in CaaS.

If the pre-validation associated with domain(s) added to OV CaaS is designated for EV or OV+S/MIME issuance, the automatic renewal process will downgrade it to only OV issuance during the next auto-renewal cycle.

If EV or S/MIME issuance is required, you can configure a separate organization pre-validation specifically for those issuance types. The CaaS auto-renewal feature is intended for OV SSL issuance and maintains organization pre-validation at the OV level.

This approach ensures that the required validation type is preserved based on your operational needs.

Auto-renewal is designed to renew only the data that was initially provided, validated, and configured, such as company information, applicant details, and assignment to the same domains originally linked to the pre-validation.

However, the UPDATEDOMAINS action must still be implemented.

For those rare cases when, for instance, organization details change, requiring re-validation of the organization and performing an out-of-cycle update for the domains, your actions will be needed to initiate re-validation providing the updated details and to re-assign the new organization pre-validation to the domain names.

For more information, see Update domains.

Domain details

The domain name added must be one of the following:

  • Fully-Qualified Domain Name (FQDN) — A complete, unambiguous, non-wildcard domain name that specifies the exact location of network resources.

  • Wildcard Domain Name — A domain record specified by using a * as the leftmost label of a domain name, allowing it to cover any subdomain at a single level under the specified domain, but not extending to subdomains of the higher levels.

For more information on FQDNs and Wildcards, see RFC 9499 - DNS Terminology.

In some instances, domain names may be eligible to be added to the subscription free of charge if they are associated with another domain in the subscription that is paid for. However, these domains must still be explicitly added to the subscription. The addition of domains may be free of charge in the following scenarios:

  • If there’s a wildcard domain in the current active subscription, adding its FQDN equivalent (for example, removing the *.) will be free of charge, but not vice versa.

    Adding the www subdomain or any other subdomain covered by an existing wildcard domain in the subscription (for example, replacing *. in the wildcard domain with www. or another label) will incur normal charges.

  • If there’s an FQDN in the current active subscription that has been paid for, adding its single www subdomain will be free of charge, but not vice versa.

    This does not apply if a wildcard domain is already present in the subscription.
Examples:

  • If domain.brand.com is added, www.domain.brand.com can be added for free thereafter.

  • If *.domain.brand.com is added, then domain.brand.com can be added for free, but adding brand.com will incur a charge.

  • If *.domain.brand.com is added, adding www.domain.brand.com, or subdomain.domain.brand.com later will incur a charge.

  • If www.domain.brand.com is added first, domain.brand.com will incur a charge.

  • If domain.brand.com is added first, *.domain.brand.com will incur a charge.

If a domain is erroneously removed from a subscription, adding it back will incur charges unless another domain in the subscription, which was paid for, can overwrite this behavior according to the above rules. For instance, if it is a single www subdomain of a registrable domain name that is still active in the subscription.

If the same domain is added to multiple EABs, the ADDDOMAIN and EXTENDDOMAINS actions will be chargeable for each domain instance.

For more details on adding a domain or extending a subscription, see Add a domain or Extend a subscription.