ZeroSSL (ACME)
Automated issuance of DV certificates via ACME with External Account Binding, integrated with ZeroSSL.
Requirements
| Requirement | Detail |
|---|---|
| ZeroSSL account | Active account on zerossl.com (the free plan works) |
| Directory URL | https://acme.zerossl.com/v2/DV90 |
| EAB | Required — Key ID and HMAC Key. Reusable, no expiration |
| CAA record | If the domain has a published CAA record, it must include 0 issue "sectigo.com" — ZeroSSL issues under the Sectigo hierarchy |
Get the credentials in ZeroSSL
- Log in to the ZeroSSL dashboard
- Go to the Developer section
- Find the EAB Credentials block and click Generate
- Copy the two values shown:
| Field in ZeroSSL | Use in the CLM |
|---|---|
| EAB KID | EAB Key ID |
| EAB HMAC Key | EAB HMAC Key |
Unlike Google Trust Services, ZeroSSL's EAB isn't single-use and doesn't expire. If a registration attempt fails, you can retry with the same credentials without generating new ones.
Connect in the CLM
ZeroSSL is registered through the generic ACME CA card.
- Go to Integrations in the sidebar menu
- On the Other CA (ACME) card, click Connect
- Fill in the Register account modal:
| Field | Description |
|---|---|
| Name | Identifier for the account in the CLM, e.g. ZeroSSL — on accounts registered through the generic card, this name is what identifies the CA across the screens |
| Contact address registered with the CA | |
| Directory URL (ACME) | https://acme.zerossl.com/v2/DV90 |
| EAB Key ID | The EAB KID copied from the dashboard |
| EAB HMAC Key | The corresponding HMAC Key. Stored encrypted and never shown again |
- Click Register
After saving, the account shows as pending registration. The CLM only registers the account with ZeroSSL on the first submitted order — that's why incorrect EAB credentials only surface an error on the first issuance, not at registration.
Details
90-day certificates. The default product (DV90) issues certificates valid for 90 days, automatically renewed by the CLM.
Wildcard and multi-SAN support. Accepts up to 100 names per certificate, including wildcards. Wildcard certificates require DNS-01 validation — in the CLM, that means manual DNS validation or automatic validation via Route 53.
Hierarchy under Sectigo. ZeroSSL doesn't operate its own root. The issued chain is:
yourdomain.com
└─ ZeroSSL RSA DV SSL CA 2
└─ Sectigo Public Server Authentication Root R46
└─ USERTrust RSA Certification Authority
This has two practical consequences: the OCSP service responds at ocsp.sectigo.com, and the CAA record must authorize sectigo.com. If the domain's CAA only authorizes zerossl.com, issuance can be rejected.
Ownership. ZeroSSL is based in Vienna, Austria, and was acquired by HID Global in January 2024. It's an issuance platform that operates on top of Sectigo's CA infrastructure — relevant if your internal trust policy evaluates roots rather than brands.
Automatic rekey on renewal. Each renewal generates a new key pair — the renewed certificate has a different serial, fingerprint, and public key from the previous one.
Common errors
CAA record does not include ... which is required to issue the certificate
Cause: the domain has a published CAA record that doesn't authorize the issuing CA.
Solution: add Sectigo's authorization to the domain's CAA record:
0 issue "sectigo.com"
If the domain doesn't have a CAA record yet, creating one makes the list restrictive — include every CA you use, not just one:
0 issue "letsencrypt.org"
0 issue "sectigo.com"
0 issue "digicert.com"
0 issue "pki.goog"
Wait for propagation (seconds on Route 53) and issue again.
400: HOST_NOT_ALLOWED when saving the integration
Cause: Directory URL entered incorrectly. The acme.zerossl.com host is accepted by default.
Solution: confirm the exact URL: https://acme.zerossl.com/v2/DV90.
Not all authorizations became valid after N attempts
Cause: domain validation wasn't completed.
Solution:
- Manual validation: publish the TXT record or the HTTP file shown on screen and confirm
- Automatic validation (Route 53): confirm the domain's zone is in the linked AWS account and that the integration has write permission on it
Error issuing a wildcard with HTTP validation
Cause: wildcard certificates can only be validated by DNS-01, a limitation of the ACME protocol itself.
Solution: choose DNS validation (manual or automatic Route 53) when issuing wildcards.
Edit
Click the ⋮ menu on the card and select Edit. You can change the name, email, Directory URL, and replace the EAB credentials. The current HMAC Key is never shown — entering a new one replaces the previous one.
Delete
Click the ⋮ menu on the card and select Delete. Unlink active certificates before removing the integration.
Next step
With the integration connected, see Issue with ZeroSSL (ACME).