With Sectigo (ACME)
Issuance of certificates through Sectigo using ACME, with automatic domain validation.
The Sectigo (ACME) integration must be registered — see Integrations → Sectigo (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | Sectigo ACME account registered under Integrations |
| Domain in the SCM | Added, validated (DCV), and delegated to the ACME account in use |
| SANs in the SCM | Every Alternative Name must also be delegated |
| CAA record | If published, must include 0 issue "sectigo.com" |
| Key | RSA — 2048, 3072, or 4096 bits |
It's not enough for the domain to exist in the SCM. It must be delegated to the organization/department and then to the specific ACME account. A domain that's registered but not delegated is rejected at issuance, even with the integration successfully connected — the connection validates the account, not domain authorization.
What changes in Step 2
Under Certificate Authority, select Sectigo (ACME). The form shows:
- ACME Account — select the registered Sectigo account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
For wildcards (*.example.com), use DNS Challenge. With Route 53 in Automatic mode, the CLM creates the TXT record and completes issuance without intervention.
After issuance
Type (DV, OV, EV) and validity follow the product linked to the ACME account in the SCM, not the wizard's fields. To issue with different parameters, configure another ACME account in the SCM and register a new integration.
Common issues
| Error | Likely cause |
|---|---|
| Domain not authorized | Domain or one of the SANs not delegated to the ACME account in the SCM |
| Invalid MAC on JWS request | Incorrect HMAC Key or copied with extra spaces — regenerate in the SCM |
| CAA rejected | CAA record doesn't authorize sectigo.com |
| Invalid Directory URL | URL from another account or product — double-check under SCM → Manage → ACME Accounts → Server |
| Unexpected validity | Set by the product in the SCM, not by the CLM |