Overview
The Integrations screen centralizes all of the CLM's connections with external providers. Integrations are organized into four categories:
| Category | Integrations |
|---|---|
| Certificate Authority | Let's Encrypt, DigiCert, Microsoft AD CS, Sectigo (ACME), DigiCert (ACME), GlobalSign (ACME), Google Trust Services (ACME), ZeroSSL (ACME), SSL.com (ACME), Other CA (ACME) |
| Load Balancer | F5 BIG-IP, Citrix NetScaler |
| Cloud | Amazon AWS (ACM + Route 53), Microsoft Azure |
| IIS | Windows IIS servers |
Certificate Authorities
| CA | Directory URL | EAB | CAA tag |
|---|---|---|---|
| Let's Encrypt | https://acme-v02.api.letsencrypt.org/directory | No | letsencrypt.org |
| Sectigo (ACME) | https://acme.sectigo.com/v2/DV | Yes | sectigo.com |
| DigiCert (ACME) | https://one.digicert.com/mpki/api/v1/acme/v2/directory | Yes | digicert.com |
| GlobalSign (ACME) | https://emea.acme.atlas.globalsign.com/directory | Yes | globalsign.com |
| Google Trust Services (ACME) | https://dv.acme-v02.api.pki.goog/directory | Yes — single-use, expires in 7 days | pki.goog |
| ZeroSSL (ACME) | https://acme.zerossl.com/v2/DV90 | Yes | sectigo.com |
| SSL.com (ACME) | https://acme.ssl.com/sslcom-dv-rsa (or -ecc) | Yes | ssl.com — required even without a published CAA record |
| Other CA (ACME) | Entered at registration | Varies | Varies |
| DigiCert | Native API — doesn't use ACME | — | digicert.com |
| Microsoft AD CS | Internal CA via agent — doesn't use ACME | — | — |
Directory URLs come pre-filled in the registration form and can be edited via the pencil icon, for accounts with a custom endpoint.
If the domain has any published CAA record, it must authorize the tag of the chosen CA, or issuance will be rejected even with the integration connected. Domains with no CAA record at all accept issuance from any CA — except SSL.com, which requires the record regardless.
These three CAs are registered through the generic Other CA (ACME) card, but have dedicated guides with the step-by-step, details, and common errors for each.
How registration works
When you click Connect and fill in the Register account modal, the CLM stores the credentials but doesn't register the account with the CA at that moment. The account stays pending registration, and the actual binding happens on the first submitted signing order.
That's why incorrect EAB credentials only surface an error on the first issuance, not at registration. The full flow is covered in Issuance flow.
The HMAC key is stored encrypted and never shown again — to change it, enter a new one in the edit modal.
Managing integrations
Each card displays the name, category, description, and connection status. Click the ⋮ menu to edit or delete.
Enable / Disable — the Integration enabled toggle pauses the automatic healthcheck without deleting the integration. Useful for temporary maintenance.
Test connection — available on integrations that support it, validates credentials and connectivity with the external service.
Request integration — didn't find what you need? Use the Request integration card to suggest a new provider.
Configuration guides
Certificate Authorities — Let's Encrypt · Sectigo (ACME) · DigiCert (ACME) · GlobalSign (ACME) · Google Trust Services (ACME) · ZeroSSL (ACME) · SSL.com (ACME) · Other CA (ACME) · DigiCert · Microsoft AD CS
Cloud — Amazon AWS · Microsoft Azure
Load Balancers — F5 BIG-IP · Citrix NetScaler
IIS — Microsoft IIS