Need help? Call Live Support at +31 (0) 38 453 07 59

Attention! You're currently using the OT&E environment.

ACME Subscriptions
Subscription model

ACME subscriptions provide automated certificate issuance, validation, and lifecycle management via the ACME protocol. By subscribing for specific domain names, whoever operates the ACME client can obtain certificates for those domains during the subscription period. This service is designed for both reselling and direct use, enabling partners to integrate it into their own offerings or utilize it for their own infrastructure needs.

For Sectigo both DV and OV certificates are supported. At this moment other brands are not yet available we are working with the provider to make them available.

Workflow
  1. Create the subscription and securely store the ACME account bindings that are returned.
  2. For OV/EV subscriptions a validation process is started when needed, the subscription has the status PENDING_ORGANIZATION_VALIDATION and the progress can be monitored using info process.
  3. Provide the ACME credentials to the customer.
  4. The customer can now create the ACME account with the provided credentials. The exact command can be found in the ACME client’s vendor documentation, a example form certbot: 
    certbot register \
  --server directoryUrl.from.response \
  --eab-kid accountKey.from.response \
  --eab-hmac-key hmacKey.from.response
  5. The customer can now request certificates for the domains included in the subscription using the acme client.
Lifecycle

Subscriptions are pre-paid for the requested period and valid until the expiryDate. On expiry the subscription is either SUSPENDED or automatically renewed for the period set on the subscription. When SUSPENDED the subscripton can still be< a href="/docs/api/ssl/acme/renew">renewed, 30 days after expiry the subscription is REVOKED and can no longer be renewed.

Subscriptions deleted within 30 days of creation are not SUSPENDED for 30 days and are refunded automatically.

For OV/EV subscriptions new organization validations are automatically started 30 days before the current organization validation is set to expire. If the validation is not completed in time the subscription status is set to PENDING_ORGANIZATION_VALIDATION and no certificates can be requested until validation is completed again.