Other CA (ACME)
Register an account with any ACME-compatible CA by providing the provider's own Directory URL. Use this card when the CA doesn't have a dedicated integration in the CLM.
Let's Encrypt, Sectigo (ACME), DigiCert (ACME), and GlobalSign (ACME) have a dedicated card in the CLM. Google Trust Services (ACME), ZeroSSL (ACME), and SSL.com (ACME) are registered through this generic card, but have their own guides with the step-by-step and details for each.
What is ACME?
ACME (Automatic Certificate Management Environment, RFC 8555) is a standard protocol for automated issuance, validation, and renewal of SSL/TLS certificates, without manual intervention.
An ACME integration relies on three elements:
- Directory URL — the endpoint that exposes the CA's ACME operations
- EAB (External Account Binding) — when required, links the ACME account created by the CLM to an existing account at the provider. It's a
Key ID+HMAC Keypair - Validation challenge — HTTP-01 or DNS-01, to prove control over the domain
Connect in the CLM
- Go to Integrations in the sidebar menu
- On the Other CA (ACME) card, click Connect
- Fill in the Register account modal:
| Field | Description |
|---|---|
| Name | Identifier for the account in the CLM |
| Contact address registered with the CA | |
| Directory URL (ACME) | The CA's endpoint. The CLM validates the URL as you type — the Checking the ACME directory message indicates the check is in progress |
| EAB Key ID | When the CA requires it |
| EAB HMAC Key | When the CA requires it. Stored encrypted and never shown again |
- Click Register
After saving, the account is pending registration. The CLM validates the Directory URL at registration, but only registers the account with the CA on the first submitted signing order — incorrect EAB credentials only surface an error at that point.
Before connecting an unlisted CA
Confirm in the provider's documentation:
- Does the CA require EAB? Some accept open registration, others require binding to an existing account
- Which algorithm does the endpoint accept? The CLM generates CSRs with an RSA key (2048, 3072, or 4096 bits). ECC-only endpoints aren't compatible
- Which CAA tag does the CA use? If the domain has a published CAA record, it must authorize the chosen CA
- Is there a domain restriction on the account? Some CAs only issue for domains pre-registered in the dashboard
Several CAs return a CAA error when the actual cause is something else — an incompatible algorithm, an already-consumed EAB, or a domain not authorized on the account. If the CAA record is correct and issuance keeps failing, review these three points before investigating DNS.
Edit
Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials.
Delete
Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.
Next step
With the integration connected, see Issue with another CA (ACME).