Skip to main content

DigiCert (ACME)

Automated issuance via the ACME protocol on DigiCert CertCentral, with External Account Binding.

Different from the DigiCert integration

The DigiCert card (without ACME) connects via native API and covers OV and EV certificates with corporate validation. This card uses the ACME protocol. These are two different connection methods for the same CA — see DigiCert.

Requirements​

RequirementDetail
CertCentral accountActive account with ACME credentials created
Directory URLhttps://one.digicert.com/mpki/api/v1/acme/v2/directory — confirm the exact value shown when creating the credentials, as it varies by region
EABRequired — KID and HMAC key
CAA recordIf the domain has a published CAA record, it must include 0 issue "digicert.com"
Legacy endpoint discontinued

DigiCert retired the CertCentral legacy ACME service on February 24, 2026, and requests to the legacy ACME URLs stopped issuing certificates as of that date. Credentials created before January 30, 2024 are considered legacy.

If your integration uses the old endpoint (acme.digicert.com), generate new credentials in CertCentral and update the Directory URL. On the Automation → ACME Directory URLs screen, legacy credentials show a warning icon in the Status column.

Get the credentials in CertCentral​

  1. Go to CertCentral
  2. In the main menu, go to Automation → ACME Directory URLs
  3. Click Add ACME Directory URL
  4. Fill in:
    • Name — identifies the credentials
    • Product — the certificate product that will be issued with them
    • User — who will own the credentials (you, another user, or a Service User)
  5. Click Add ACME Directory URL and copy the Directory URL, the KID, and the HMAC key
Credentials shown only once

EAB credentials can't be recovered later. If you lose them, you'll need to generate a new set.

Connect in the CLM​

  1. Go to Integrations in the sidebar menu
  2. On the DigiCert (ACME) card, click Connect
  3. Fill in the Register account modal:
FieldDescription
NameIdentifier for the account in the CLM
EmailContact address registered with the CA
Directory URL (ACME)Pre-filled. Click the pencil icon to edit according to the value shown in CertCentral
EAB Key IDThe KID generated in CertCentral
EAB HMAC KeyThe corresponding HMAC key. Stored encrypted and never shown again
  1. Click Register
The account is registered on the first issuance

After saving, the account is pending registration. The CLM only registers the account with DigiCert on the first submitted signing order.

Details​

The credentials define the product. Each set of ACME credentials is linked to a certificate product chosen at creation. The certificate's type and validity follow that product, not the CLM's fields. To issue a different type, generate a new set of credentials and register a new integration.

Validation differs between DV and OV/EV. For DV certificates, CertCentral dynamically validates domain control through the ACME protocol. For OV/EV with a pre-validated domain in CertCentral, validation happens outside the ACME flow.

Edit​

Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials.

Delete​

Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.

Next step​

With the integration connected, see Issue with DigiCert (ACME).