With SSL.com (ACME)
Issuance of certificates through SSL.com using ACME, with automatic domain validation.
The SSL.com (ACME) integration must be registered through the Other CA (ACME) card — see Integrations → SSL.com (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | SSL.com ACME account registered under Integrations, through the generic card |
| CAA record | Required, even if the domain doesn't have a CAA record today. Must include 0 issue "ssl.com" |
| Key | RSA or ECC — follows the endpoint chosen when the integration was registered, not selectable in the wizard |
| Account balance | Zero, if you intend to use the free 90-day certificate |
Unlike other supported CAs, SSL.com refuses issuance if the domain doesn't have a CAA record authorizing 0 issue "ssl.com" — even when the domain has no CAA record at all. Configure the record before issuing. Details in Integrations → SSL.com (ACME).
What changes in Step 2
Under Certificate Authority, select the registered SSL.com account (the name is whatever you entered at registration, e.g. SSL.com). The form shows:
- ACME Account — select the registered account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
The certificate's key algorithm (RSA or ECC) is set by the Directory URL configured in the integration (sslcom-dv-rsa or sslcom-dv-ecc), not by a wizard field. To issue both types, register two integrations.
After issuance
If the SSL.com account had a zero balance at the moment of issuance, the certificate is the free 90-day product. If there was available balance, issuance consumes it and produces a paid 1-year certificate — there's no way to revert this after issuance.
Common issues
| Error | Likely cause |
|---|---|
CAA record does not include ssl.com which is required to issue the certificate | Domain without a CAA record authorizing ssl.com — happens even with no CAA published at all |
| Certificate issued with 1-year validity instead of 90 days | SSL.com account had available balance at the moment of issuance |
400: HOST_NOT_ALLOWED when saving the integration | Incorrect Directory URL — confirm sslcom-dv-rsa or sslcom-dv-ecc |
Not all authorizations became valid after N attempts | Domain validation not completed, or CAA doesn't authorize ssl.com |
For the CAA configuration walkthrough and more details on each error, see Integrations → SSL.com (ACME).