GlobalSign (ACME)
Automated issuance via GlobalSign Atlas ACME, with External Account Binding.
Requirements
| Requirement | Detail |
|---|---|
| Atlas account | Active account on the GlobalSign Atlas platform, with validated organization information |
| Directory URL | https://emea.acme.atlas.globalsign.com/directory |
| EAB | Required — API Key (Key ID) and MAC Key |
| CAA record | If the domain has a published CAA record, it must include 0 issue "globalsign.com" |
Get the credentials in Atlas
- Go to the GlobalSign Atlas portal
- Generate an API credential pair in the credentials section
- Copy the API Key (used as Key ID) and the MAC Key
The MAC Key can only be copied at the moment it's generated — GlobalSign doesn't store it and it won't be visible again in the portal. Each MAC Key has a maximum validity of 30 days or up to 1000 uses, whichever comes first; remaining validity and uses appear on the credential's card in the Atlas portal.
Since the CLM only registers the account on the first issuance, generate the MAC Key close to when you'll issue the first certificate. If it expires before that, registration fails and you'll need to generate a new pair.
Connect in the CLM
- Go to Integrations in the sidebar menu
- On the GlobalSign (ACME) card, click Connect
- Fill in the Register account modal:
| Field | Description |
|---|---|
| Name | Identifier for the account in the CLM, e.g. GlobalSign Atlas |
| Contact address registered with the CA | |
| Directory URL (ACME) | Pre-filled with https://emea.acme.atlas.globalsign.com/directory |
| EAB Key ID | The Atlas API Key |
| EAB HMAC Key | The corresponding MAC Key. Stored encrypted and never shown again |
- Click Register
After saving, the account is pending registration. The CLM only registers the account with GlobalSign on the first submitted signing order.
Details
Credentials are tied to the algorithm. Atlas credentials are associated with an RSA or ECC certificate product. Since the CLM generates CSRs with an RSA key, use credentials tied to the RSA product — ECC product credentials result in issuance failure.
Credential rotation is routine, not an exception. Due to the 30-day or 1000-use limit, the MAC Key needs to be renewed periodically. When generating a new pair in Atlas, update the integration in the CLM and revoke the old credentials in the portal.
Public and private certificates. Atlas issues both publicly and privately trusted certificates, depending on the product tied to the credentials.
Edit
Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials — this is where you rotate the MAC Key.
Delete
Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.
Next step
With the integration connected, see Issue with GlobalSign (ACME).