ACME Endpoint Configuration and Client Setup

This page covers the technical detail behind the Trustico® Certificate as a Service (CaaS) ACME endpoints. It is written for developers and system administrators who want to configure the endpoint directly, rather than through a control panel. Learn About ACME Endpoints Explained 🔗

Standards Based Automation

The Trustico® endpoints implement the Automatic Certificate Management Environment (ACME) protocol, defined by the Internet Engineering Task Force in RFC 8555. Any client that follows the standard can use them, so you are never tied to a single tool.

The one addition beyond the standard is External Account Binding (EAB), which links each request to your license. Every current ACME client supports it, so your credentials stay in your control and your choice of client stays open.

Endpoint Addresses

Trustico® provides a separate endpoint for each product line. Your External Account Binding (EAB) credentials are matched to one endpoint, and you must use the address supplied with them.

The Trustico® endpoints use the trust-provider.com host, with a final segment that selects Domain Validation (DV) or Organization Validation (OV).

https://acme.trust-provider.com/v2/TrusticoDV

https://acme.trust-provider.com/v2/TrusticoOV

Sectigo® is the Certificate Authority (CA) behind these SSL Certificates, and its own product line uses the sectigo.com host.

https://acme.sectigo.com/v2/DV

The host name is presented by the Sectigo® service, so a client must contact the address exactly as supplied. Pointing a different host name at the same service through a redirect or an alias will fail, because the security check expects the original address.

Directory Discovery Document

Each endpoint address returns a directory document when your client requests it. The document is public, requires no authentication, and lists the address for every type of request the client will make.

The document includes addresses for creating an account, requesting an order, revoking an SSL Certificate, and rotating an account key. It also references a reissue timing service that advises the client when to replace an SSL Certificate, and it confirms that External Account Binding (EAB) is required.

The document lists the Certification Authority Authorization (CAA) identities that the Sectigo® service honors, and it links the subscriber agreement your client accepts during registration. Your client reads all of this automatically.

External Account Binding Registration

Registration is the first exchange between your client and the endpoint. Because the endpoint requires External Account Binding (EAB), the registration request must carry your credentials.

You provide three values to your client : the endpoint address, your EAB Key Identifier, and your EAB Message Authentication Code (MAC) Key. Your client generates its own account key and signs the registration with your credentials.

Register the account as a distinct first step, before you request any SSL Certificate. Some clients can combine registration with the first order, but performing it on its own makes sure your External Account Binding (EAB) credentials are recorded correctly. Learn About External Account Binding (EAB) Credentials 🔗

Client Configuration

Every modern ACME client accepts the three values above. The option names differ between clients, but the process is the same : supply the endpoint and the credentials, register, then request your SSL Certificates.

A registration command follows the same shape across clients. The example below shows the values you supply, using placeholders for your own credentials and endpoint.

certbot register --server YOUR_ACME_SERVER_URL --eab-kid YOUR_EAB_KEY_ID --eab-hmac-key YOUR_EAB_MAC_KEY --email your@email.com

Replace the placeholders with your endpoint address and your credentials. After registration, request SSL Certificates in the normal way for your client. Learn About Supported ACME Clients 🔗

Domain Validation Methods

Each SSL Certificate request proves that you control the domain. The protocol defines three challenge types, HTTP-01, DNS-01, and TLS-ALPN-01, and the Trustico® endpoints validate through the HTTP-01 and DNS-01 methods.

HTTP-01 places a file at a known path on your web server, which the Certificate Authority (CA) fetches over port 80. It is the simplest option for a single server that is reachable from the public internet.

DNS-01 adds a temporary record to your domain zone, so it works even when no web server is exposed. Wildcard SSL Certificates must use DNS-01, because a wildcard covers a class of subdomains that no single file could prove. Learn About The Validation Procedure 🔗

Hosted Tool Configuration File

The Trustico® hosted issuance tool produces a configuration file when you use it. The file records your endpoint, your credentials, the account it registered, and the SSL Certificate it issued, so you can keep everything together in one place.

Because the file holds your account material and your credentials, treat it as sensitive. Store it securely, and never send it by e-mail or attach it to a support request.

The file can be loaded back into the tool later to reuse the same account, which saves repeating validation. It is a convenient record for anyone who issues SSL Certificates through the browser rather than a client. Explore the Hosted Issuance Tool 🔗

cPanel Plugin Files

The Trustico® cPanel Plugin manages everything from within your hosting control panel, so most customers never handle files directly. For those who want to understand what it stores, the plugin keeps its working files under your account.

These files hold the account registration and the issued SSL Certificate, along with a small amount of status information. The plugin uses them to reissue automatically, and it reinstalls each SSL Certificate through cPanel without any action from you. Explore the Trustico® cPanel Plugin 🔗

Account Reuse Across Tools

An ACME account is defined by its account key and the endpoint it registered against. Any tool that holds these can continue to reissue for the same account, which helps when you move between a client, the hosted tool, and the cPanel plugin.

Reusing one account keeps a single record of validation and a single history. For most customers this is optional. Registering a fresh account against the same credentials on each server is equally valid, and often simpler.

Whichever you choose, keep your account key private. Move it only when you need to, and only over a secure channel that you control.

Troubleshooting Configuration Issues

Most problems come down to credentials, the endpoint address, or domain validation. A short check of each usually finds the cause.

If registration is refused, confirm that your credentials are entered exactly and that they match the endpoint you are using. A Domain Validation (DV) credential will not register against an Organization Validation (OV) endpoint.

If validation fails, confirm that your domain points to the correct server and that any firewall allows the method you chose. If issuance is refused after a period of success, check that your license is still active. Learn About The Validation Procedure 🔗

What Trustico® Provides

The role of Trustico® is to provide the license that entitles you to issue SSL Certificates, together with the endpoint and the credentials needed for issuance. Trustico® also makes complimentary tools available, such as the cPanel Plugin and the hosted issuance tool, for environments that support them.

Configuring your client, completing validation, and troubleshooting your own environment rest with you, because they depend on your server, your domain, and the software you have chosen. Each ACME client has its own documentation and active community, which is the best place for questions about that client.

Keep your credentials private at all times, and never share your External Account Binding (EAB) Message Authentication Code (MAC) Key. Learn About Ordering and Management 🔗