SSL.com (ACME)

Automated issuance of DV certificates via ACME with External Account Binding, integrated with the SSL.com portal.

Requirements

Requirement	Detail
SSL.com account	Active account on ssl.com (the free standard plan works)
Directory URL	`https://acme.ssl.com/sslcom-dv-rsa` (RSA) or `https://acme.ssl.com/sslcom-dv-ecc` (ECC)
EAB	Required — Account/ACME Key and HMAC Key
CAA record	Required, even if the domain doesn't have a CAA record today. Must include `0 issue "ssl.com"`

SSL.com requires an explicit CAA record

This is the most important detail of this integration. Under the CA/Browser Forum standard, a domain without a CAA record authorizes any CA to issue — that's how Let's Encrypt, Sectigo, DigiCert, Google, and ZeroSSL work with no extra configuration.

SSL.com takes a stricter stance: it requires explicit authorization and refuses issuance even when the domain has no CAA record at all. Configure the CAA record before attempting to issue.

Get the credentials in SSL.com

Log in to the SSL.com portal
In the Dashboard, find the developers and integration section
Click api credentials
Copy the two values shown (each has a clipboard icon to copy):

Field in SSL.com	Use in the CLM
Account / ACME Key	EAB Key ID
HMAC Key	EAB HMAC Key

As an alternative, the issue via ACME link, under billing and purchase, leads to the same flow with the credentials in context.

Credentials are also sent by email

If no SSL.com account exists for the email used in an ACME flow, an account is created automatically and the EAB credentials are sent by email. Check your inbox if you can't find the values in the dashboard.

Check the account balance before issuing

In the Dashboard, under billing and purchase, check the available funds field.

Balance	Issuance result
`$0.00`	Free 90-day certificate
Greater than zero	Paid 1-year certificate, debited from the balance

A balance on the account triggers automatic charges

If there's available balance on the SSL.com account, issuing via ACME consumes that balance to issue a paid 1-year certificate instead of the free 90-day one. There's no known way to force the free product when a balance exists. If you intend to use only the free product, keep the balance at zero.

Configure the CAA record

This step is required for SSL.com and must be done before the first issuance.

If the domain doesn't have a CAA record yet

Create a CAA record on the root domain, including every CA you use — not just SSL.com:

issue "ssl.com"
issue "letsencrypt.org"
issue "sectigo.com"
issue "digicert.com"
issue "pki.goog"

Creating a CAA record makes the list restrictive

While the domain has no CAA record, every CA is authorized. The moment you create the record, only the listed CAs can issue. If you list only SSL.com, you'll block every other integration that works today.

If the domain already has a CAA record

Add a line to the existing record:

0 issue "ssl.com"

Validate the publication

After saving, confirm the record has propagated:

dig +short CAA yourdomain.com

Propagation on Route 53 usually takes seconds. SSL.com may cache the previous lookup for a few minutes — if issuance fails right after the change, wait and try again.

Connect in the CLM

SSL.com is registered through the generic ACME CA card.

Go to Integrations in the sidebar menu
On the Other CA (ACME) card, click Connect
Fill in the Register account modal:

Field	Description
Name	Identifier for the account in the CLM, e.g. `SSL.com` — on accounts registered through the generic card, this name is what identifies the CA across the screens and reports
Email	Contact address registered with the CA
Directory URL (ACME)	`https://acme.ssl.com/sslcom-dv-rsa` for RSA keys, or `https://acme.ssl.com/sslcom-dv-ecc` for ECC
EAB Key ID	The Account/ACME Key copied from the dashboard
EAB HMAC Key	The corresponding HMAC Key. Stored encrypted and never shown again

Click Register

The account is registered on the first issuance

After saving, the account shows as pending registration. The CLM only registers the account with SSL.com on the first submitted order — that's why incorrect EAB credentials only surface an error on the first issuance, not at registration.

Details

Endpoint by key type. SSL.com maintains separate endpoints for RSA (sslcom-dv-rsa) and ECC (sslcom-dv-ecc). The issued certificate's key type follows the endpoint chosen when the integration was registered. To issue both types, register two integrations.

Limited free product. The free 90-day certificate covers one domain plus the corresponding www. Certificates with more SANs or wildcards require a paid product.

Unverified account. New accounts show as Unverified / INCOMPLETE in the dashboard. For DV certificates, this doesn't block issuance — DV validation is only about domain control. Identity verification is only needed for IV, OV, and EV certificates.

CAA lookup cache. SSL.com may retain the result of a previous CAA lookup for a few minutes. DNS changes may not reflect immediately on the next issuance attempt.

Common errors

`Data does not contain required DNSNAME field.. CAA record does not include ssl.com which is required to issue the certificate`

Cause: the domain doesn't have a CAA record authorizing SSL.com. This happens even when the domain has no CAA record at all — unlike other CAs, SSL.com requires explicit authorization.

Solution:

Create or edit the domain's CAA record to include:
```
0 issue "ssl.com"
```
If you're creating the record from scratch, also include every other CA in use (see the Configure the CAA record section)
Confirm propagation:
```
dig +short CAA yourdomain.com
```
Wait a few minutes before resubmitting the order — SSL.com may be using a cached result from the previous lookup
Issue again

The first part of the message (Data does not contain required DNSNAME field) accompanies the CAA error and usually resolves along with it.

`400: HOST_NOT_ALLOWED` when saving the integration

Cause: Directory URL entered incorrectly. The acme.ssl.com host is accepted by default.

Solution: confirm the exact URL: https://acme.ssl.com/sslcom-dv-rsa (or -ecc).

Certificate issued with 1-year validity instead of 90 days

Cause: the SSL.com account had available balance at the moment of issuance, and the balance was consumed to issue a paid certificate.

Solution: there's no way to revert an issuance that already happened. To use only the free product in future issuances, keep the available funds field at zero.

`Not all authorizations became valid after N attempts`

Cause: domain validation wasn't completed.

Solution:

Manual validation: publish the TXT record or the HTTP file shown on screen and confirm
Automatic validation (Route 53): confirm the domain's zone is in the linked AWS account and has write permission
Also confirm the CAA record authorizes ssl.com — without it, validation never completes

Edit

Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials. The current HMAC Key is never shown — entering a new one replaces the previous one.

Delete

Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.

External references

SSL.com — ACME documentation

Next step

With the integration connected, see Issue with SSL.com (ACME).

SSL.com (ACME)

Requirements​

Get the credentials in SSL.com​

Check the account balance before issuing​

Configure the CAA record​

If the domain doesn't have a CAA record yet​

If the domain already has a CAA record​

Validate the publication​

Connect in the CLM​

Details​

Common errors​

Data does not contain required DNSNAME field.. CAA record does not include ssl.com which is required to issue the certificate​

400: HOST_NOT_ALLOWED when saving the integration​

Certificate issued with 1-year validity instead of 90 days​

Not all authorizations became valid after N attempts​

Edit​

Delete​

External references​

Next step​