With GlobalSign (ACME)
Issuance of certificates through GlobalSign Atlas using ACME, with automatic domain validation.
The GlobalSign (ACME) integration must be registered — see Integrations → GlobalSign (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | GlobalSign ACME account registered under Integrations |
| Valid MAC Key | Maximum of 30 days or 1000 uses, whichever comes first |
| RSA credentials | Atlas credentials are tied to an RSA or ECC product. Use the RSA ones |
| CAA record | If published, must include 0 issue "globalsign.com" |
| Key | RSA — 2048, 3072, or 4096 bits |
Since the CLM only registers the account on the first submitted signing order, a MAC Key generated too far in advance may expire before it's used. Check the remaining validity and uses on the credential's card in the Atlas portal.
What changes in Step 2
Under Certificate Authority, select GlobalSign (ACME). The form shows:
- ACME Account — select the registered GlobalSign account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
After issuance
Type and validity follow the product tied to the credentials in Atlas. Atlas issues both publicly and privately trusted certificates, depending on the contracted product.
Plan for periodic MAC Key rotation: once it reaches 30 days or 1000 uses, generate a new pair in Atlas, update the integration in the CLM, and revoke the old credentials in the portal.
Common issues
| Error | Likely cause |
|---|---|
| EAB rejected | MAC Key expired (30 days), exhausted (1000 uses), or copied incorrectly |
| Issuance fails with a valid credential | Credentials tied to the ECC product — use the RSA ones |
| CAA rejected | CAA record doesn't authorize globalsign.com |
| Lost MAC Key | Not recoverable — generate a new pair in the Atlas portal |