With DigiCert (ACME)
Issuance of certificates through DigiCert CertCentral using ACME, with automatic domain validation.
The DigiCert (ACME) integration must be registered — see Integrations → DigiCert (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | DigiCert ACME account registered under Integrations |
| Current credentials | Created on CertCentral's current ACME service — legacy credentials no longer issue |
| CAA record | If published, must include 0 issue "digicert.com" |
| Key | RSA — 2048, 3072, or 4096 bits |
Requests to CertCentral's legacy ACME URLs stopped issuing certificates on February 24, 2026. If issuance fails right at account registration, check under Automation → ACME Directory URLs whether the credentials are marked as legacy — if so, generate a new set and update the integration.
What changes in Step 2
Under Certificate Authority, select DigiCert (ACME). The form shows:
- ACME Account — select the registered DigiCert account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
After issuance
The certificate product was set when the ACME credentials were created in CertCentral and determines type and validity — the wizard's fields don't override this. To issue a different type, generate a new set of credentials and register a new integration.
For DV certificates, CertCentral validates domain control dynamically through ACME. For OV/EV with a pre-validated domain, validation happens outside the ACME flow.
Common issues
| Error | Likely cause |
|---|---|
| Account registration failure | Legacy ACME credentials — generate new ones in CertCentral |
| EAB rejected | Incorrect KID or HMAC key. Not recoverable: generate a new set |
| CAA rejected | CAA record doesn't authorize digicert.com |
| Unexpected certificate type | Set by the product tied to the credentials, not by the CLM |