Sectigo (ACME)
Automated issuance of DV certificates via ACME with External Account Binding, integrated with the Sectigo Certificate Manager (SCM).
Requirements
| Requirement | Detail |
|---|---|
| SCM account | Active account on the Sectigo Certificate Manager with an ACME account created |
| Directory URL | https://acme.sectigo.com/v2/DV (default). Varies by product — OV accounts use /v2/OV, enterprise accounts use enterprise.acme.sectigo.com |
| EAB | Required — Key ID and HMAC Key |
| Delegated domains | Each domain must be added in the SCM and delegated to the ACME account |
| CAA record | If the domain has a published CAA record, it must include 0 issue "sectigo.com" |
Get the credentials in the SCM
- Go to the Sectigo Certificate Manager
- Go to Manage → ACME Accounts and click Manage on the desired account
- Copy the values:
| SCM field | Use in the CLM |
|---|---|
| Server | Directory URL (ACME) |
| Key ID | EAB Key ID |
| HMAC Key | EAB HMAC Key |
Key ID and HMAC Key appear in the External Account Binding section of the same screen.
Unlike Let's Encrypt, Sectigo's ACME credentials cover every domain delegated to the account, not just one. Whoever obtains this pair can issue unlimited certificates for any of those domains. Treat it with the same care as a private key.
Connect in the CLM
- Go to Integrations in the sidebar menu
- On the Sectigo (ACME) card, click Connect
- Fill in the Register account modal:
| Field | Description |
|---|---|
| Name | Identifier for the account in the CLM, e.g. Sectigo Production |
| Contact address registered with the CA | |
| Directory URL (ACME) | Pre-filled with https://acme.sectigo.com/v2/DV. Click the pencil icon to edit if your account uses a different endpoint |
| EAB Key ID | The Key ID copied from the SCM |
| EAB HMAC Key | The corresponding HMAC Key. Stored encrypted and never shown again |
- Click Register
After saving, the account is pending registration. The CLM only registers the account with Sectigo on the first submitted signing order — that's why incorrect EAB credentials only surface an error on the first issuance, not at registration.
Details
The domain must be delegated. It's not enough for the domain to exist in the SCM: it must be delegated to the organization/department and then to the specific ACME account. A domain that's registered but not delegated is rejected at issuance, even with the integration connected.
All SANs follow the same rule. Every domain entered as an Alternative Name must be delegated, not just the Common Name.
The product defines the certificate. Type (DV, OV, EV) and validity follow the product linked to the ACME account in the SCM, not the CLM's fields. To issue with different parameters, create another ACME account in the SCM with the desired product and register a new integration.
Edit
Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials. The current HMAC Key is never shown — entering a new one replaces the previous one.
Delete
Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.
Next step
With the integration connected, see Issue with Sectigo (ACME).