ACME providers and external account binding¶

In the Windows Agent, choose Names & authority → ACME account → Create a new account. Enter an account name and contact email, select the authority, and review its terms. The presets fill in the directory URL. Custom ACME directory accepts another HTTPS directory and optional EAB credentials. On Linux, add the account on the terminal interface's Settings screen (a under ACME accounts) and set its EAB secret with s, or use secret set eab. When the Agent registers an account, its log (on Linux the journal) names the account by its ID and directory, not by its contact email.

For a provider requiring External Account Binding, enter EAB KID (key ID) and EAB HMAC Key during setup. Both are required together. The HMAC key can be pasted as shown by the CA, in base64url or in standard base64 (with +, / and = padding); the Agent converts it. The HMAC field is masked and the Agent stores it encrypted before enabling automatic renewal or requesting issuance. It is not included in workflow configuration or the review summary. Existing registered accounts can be reused without entering EAB again. To rotate a saved key, use the account controls under Edit workflow….

The stored HMAC is bound to the account's directory URL and EAB key ID. If you change either on an account that has not registered yet, enter the HMAC again; registration otherwise fails with EAB secret unavailable. The Agent also pins every ACME request to the directory's origin and does not follow redirects to other hosts.

Every preset except Let's Encrypt requires EAB. Each directory URL in the table is the one the CA publishes in its own documentation, linked in the sections below. Staging certificates are for testing and are not publicly trusted. Let's Encrypt profiles are shown only for Let's Encrypt directories. Provider presets configure account setup; issuance still depends on CA eligibility and successful validation through the Agent's Delegated DNS-01 workflow.

When an account uses a preset, the Agent reports it to CertIntel, and the issuer choice of a dashboard assignment shows it as ACME: <account name> (<preset name>). To set an account up once for every Agent of an organization instead of on each device, see Organization ACME accounts. The Agent also follows the renewal window a CA suggests through ACME Renewal Information (ARI) when the directory offers it; see when a certificate renews.

Organization ACME accounts¶

An Agent can also use ACME accounts that an administrator defines once for a whole organization in the CertIntel dashboard, so nobody has to type the CA's EAB credentials on every device.

1. Open Settings → ACME Accounts (needs the acme_accounts.create permission, which the built-in Administrator role holds; Viewers, Observers, Auditors and Operators can see the list).
2. Choose the Organization, a Name (one line, without control characters) and optionally an Account id (lowercase letters, digits, - and _; derived from the name when blank - Agents store the account as org-<id>).
3. Choose the Certificate authority from the presets in the table above; the Directory URL field then shows that CA's URL and cannot be edited. For a CA that is not listed, choose Other ACME CA and enter its Directory URL (https:// only). The form starts with Let's Encrypt (production) selected and named.
4. Enter the Contact email the CA should use (the form fills in your own address), and the EAB key ID and EAB HMAC key when the CA requires external account binding (the presets marked needs EAB refuse to save without them; base64 or base64url as the CA shows it).
5. Tick the box to accept the CA's terms of service on behalf of every Agent that uses the account, and Add account (Add account and go back when you came from the workflow form or Get a certificate for a server).

Get a certificate for a server on the Overview creates this account for you when the organization has none for the chosen certificate authority.

At most 16 accounts per organization. Accounts cannot be edited: delete one and add it again. The EAB HMAC key is never shown again after you save it; it is stored encrypted and sent only to the organization's enrolled Agents. The same can be done through the API (GET/POST /api/v1/acme-accounts, GET/DELETE /api/v1/acme-accounts/{id}).

On the device:

• The Agent reads the organization's accounts when it starts, every hour, at its next heartbeat after one is added or deleted (the heartbeat tells it the list changed), and when an assignment names an account it has not read yet. certintel status --json shows the state under platform_acme_accounts.
• If its local auto-apply policy covers the organization and the configuration lock is off, it adds the accounts to its configuration. The desktop app and terminal interface list them with (platform); change them in the dashboard (delete and add again), not on the device: the next read replaces local edits.
• Otherwise it adds an account only when a local administrator approves a dashboard assignment that uses it.
• An account configured on the device with the same ID always wins. Deleting an account in the dashboard removes it from the Agents that add accounts under auto-apply, except on a device where a certificate still uses it: that device keeps it until no certificate does. Other Agents keep an account an approval added.
• Every device registers its own account (and account key) with the CA the first time it issues. CAs whose EAB key registers only one account - Google Trust Services - therefore need one organization account per device.

CAA records¶

When a domain has CAA records, they must name the CA, or it refuses to issue. The issuer name to add (example.com. CAA 0 issue "<name>") for each preset, and the other names the same CA accepts, so a domain whose records already name one of them needs no change:

The names are the ones each CA publishes in its CP/CPS or CAA help page, and for the ACME CAs in the caaIdentities of its directory, as read on 2026-11-10. Sectigo calls comodo.com and comodoca.com deprecated, so add sectigo.com to a new record.

For a certificate a public endpoint already serves, CertIntel also knows Amazon (AWS Certificate Manager): amazon.com, amazontrust.com, awstrust.com, amazonaws.com, amazontrustservices.eu, amazonaws.eu, amznts.eu and aws.amazon.com.

CertIntel checks these before you propose a workflow and on Delegated DNS-01 records and Public Endpoints; see CAA records. A custom ACME directory cannot be checked: look up the issuer name in its CA's documentation.

ZeroSSL.com¶

Create a ZeroSSL account, then generate EAB credentials in the dashboard's Developer section. Copy the KID and HMAC key into setup. A ZeroSSL API access key is a different credential and cannot replace these EAB values. See ZeroSSL ACME documentation.

SSL.com¶

In your SSL.com dashboard, open API credentials under developers and integration. Use the Account/ACME Key as EAB KID and the HMAC Key as EAB HMAC Key. Choose ECC for an ECDSA certificate or RSA for an RSA certificate; the wizard selects a compatible key type and rejects mismatches. Check account and product charges with SSL.com. See SSL.com ACME instructions.

Actalis.com¶

Enable ACME for an eligible certificate in the Actalis Customer Area. Under Manage with ACME → ACME Credentials, copy KID and KEY into the two EAB fields. Confirm your certificate product's eligibility and supported validation methods before issuance. See Actalis activation instructions and ACME eligibility FAQ.

Google Trust Services¶

Google Public CA requires a Google Cloud project, the Public CA API enabled, and permission to create external account keys (roles/publicca.externalAccountKeyCreator). The EAB credentials bind the ACME account to that project. The application can be hosted outside Google Cloud. Domain control is verified through ACME challenges; the documented process does not require prior Search Console verification or Google-hosted DNS. See Public CA overview and Google's setup tutorial.

After selecting the project in Google Cloud CLI, enable the API and generate a production credential:

gcloud services enable publicca.googleapis.com
gcloud publicca external-account-keys create

Copy keyId into EAB KID and b64MacKey into EAB HMAC Key. A credential registers one account and expires after seven days if unused. Reuse the registered account for renewals; retain its Google Cloud project. Because each device registers its own account, an organization ACME account for Google Trust Services works on one device only: create one per device.

For staging, generate separate credentials using the staging API:

gcloud config set api_endpoint_overrides/publicca https://preprod-publicca.googleapis.com/
gcloud publicca external-account-keys create
gcloud config unset api_endpoint_overrides/publicca

Select the matching Google staging directory in the Agent. Production and staging credentials are not interchangeable.

DigiCert¶

DigiCert's ACME service is part of CertCentral. Create ACME credentials in your CertCentral account and copy the key ID (KID) and HMAC key it shows into EAB KID and EAB HMAC Key. Choose the preset for the region your CertCentral account is provisioned in - US, EU or Japan; DigiCert rejects enrollment when the directory and the account's region do not match. See DigiCert's regional directory URLs.

The older https://acme.digicert.com/v2/acme/directory/ belongs to DigiCert's legacy ACME service and is not offered; new credentials use the regional directories.

Agent 1.13.0 and earlier: the DigiCert — US preset on the device points at one.us.digicert.com, a host that does not exist, so the account cannot register. Update the Agent to 1.13.1 or later, or choose Custom ACME directory and enter the US URL from the table above. An organization ACME account created in the dashboard uses the right URL with any Agent version.

Sectigo¶

The Sectigo — DV and Sectigo — OV presets use Sectigo's public ACME servers; the only difference between them is the directory. Use the EAB key ID and HMAC key Sectigo issued for your ACME account. For OV certificates, organization validation must be complete before issuance. See Sectigo's list of ACME servers and OV getting started.

A Sectigo Certificate Manager account that was given its own, account-specific ACME URL (in the portal under Manage → ACME Accounts) should use Custom ACME directory with that URL instead.

GlobalSign¶

GlobalSign Atlas — EMEA uses GlobalSign's published Atlas ACME endpoint. Copy the EAB key ID and HMAC key from your Atlas ACME settings. GlobalSign publishes only the EMEA endpoint; for an endpoint in another region, use Custom ACME directory. See GlobalSign's ACME getting started.

GoDaddy¶

There is no GoDaddy preset. GoDaddy explains where to find the EAB key ID and key data on its ACME Setup page, but does not publish a directory URL, so CertIntel cannot ship one it can confirm. Choose Custom ACME directory and enter the directory URL, EAB key ID and HMAC key shown on your GoDaddy ACME Setup page. See GoDaddy's ACME setup help.