With another CA (ACME)
Issuance of certificates by an ACME-compatible CA without a dedicated card in the CLM.
Before you start
The Other CA (ACME) integration must be registered — see Integrations → Other CA (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | ACME account registered with the provider's Directory URL |
| EAB credentials | When the CA requires them |
| CAA record | If published, must authorize the chosen CA's tag |
| Key | RSA — 2048, 3072, or 4096 bits. ECC-only endpoints aren't compatible |
| Authorized domain | Some CAs only issue for domains pre-registered in the dashboard |
What changes in Step 2
Under Certificate Authority, select Other CA (ACME). The form shows:
- ACME Account — select the registered account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
Your CA might have its own guide
Google Trust Services (ACME), ZeroSSL (ACME), and SSL.com (ACME) are also registered through this generic card, but have dedicated guides with the step-by-step and details for each.
Common issues
| Error | Likely cause |
|---|---|
| CAA rejected | CAA record doesn't authorize the CA's tag — or the endpoint requires ECC |
| EAB rejected | Invalid credential, already consumed, or bound to another ACME account |
| Domain not authorized | Domain not registered on the CA's account |
| HTTP-01 challenge expired | Port 80 blocked or redirecting — use DNS Challenge |
Misleading CAA errors
Several CAs return a CAA error when the actual cause is something else — an incompatible algorithm, a consumed EAB, or an unauthorized domain. If the CAA record is correct and issuance keeps failing, review these three points before investigating DNS.