With ZeroSSL (ACME)
Issuance of certificates through ZeroSSL using ACME, with automatic domain validation.
The ZeroSSL (ACME) integration must be registered through the Other CA (ACME) card — see Integrations → ZeroSSL (ACME). The full wizard walkthrough is in Issuance flow.
Requirements
| Requirement | Detail |
|---|---|
| Registered integration | ZeroSSL ACME account registered under Integrations, through the generic card |
| CAA record | If published, must include 0 issue "sectigo.com" — ZeroSSL issues under the Sectigo hierarchy |
| Key | RSA — 2048, 3072, or 4096 bits |
| Wildcards | Require DNS-01 validation — issuing a wildcard with HTTP Challenge isn't possible |
What changes in Step 2
Under Certificate Authority, select the registered ZeroSSL account (the name is whatever you entered at registration, e.g. ZeroSSL). The form shows:
- ACME Account — select the registered account
- Validation Method — HTTP Challenge or DNS Challenge
- DNS Auto-Validation (AWS Route 53) — available when choosing DNS Challenge
For wildcard domains (*.example.com), choose DNS Challenge — HTTP Challenge doesn't validate wildcards, a limitation of the ACME protocol itself.
After issuance
ZeroSSL's default product (DV90) issues certificates valid for 90 days, automatically renewed by the CLM. Each renewal generates a new key pair — the renewed certificate has a different serial, fingerprint, and public key from the previous one.
Common issues
| Error | Likely cause |
|---|---|
CAA record does not include ... which is required to issue the certificate | CAA record doesn't authorize sectigo.com — ZeroSSL issues under the Sectigo root, not zerossl.com |
| Error issuing a wildcard with HTTP validation | Wildcards can only be validated by DNS-01 — choose DNS Challenge |
Not all authorizations became valid after N attempts | Domain validation not completed — confirm the TXT record/HTTP file or write permission on the Route 53 zone |
400: HOST_NOT_ALLOWED when saving the integration | Incorrect Directory URL — confirm https://acme.zerossl.com/v2/DV90 |
For more details on the trust hierarchy and the history behind each error, see Integrations → ZeroSSL (ACME).