3.1 ACME Issuers
Bring your own CA, not just Let's Encrypt.
An Issuer is an ACME account configured for a Certificate Authority. Let’s Encrypt is built-in and ready for use. Other CAs require External Account Binding (EAB) credentials, which you generate at the CA and provide to CertKit.
Issuers are configured at the account level. Once set up, any certificate in any Collection can use them.
Capability Matrix
ACME support varies by CA. The features supported by your chosen CA determine which options are available when creating a certificate.
| Issuer | EAB | DNS-PERSIST | Profiles | ARI |
|---|---|---|---|---|
| Let’s Encrypt | — | Coming Soon | shortlived and tlsserver |
Yes |
| Actalis | Required | — | — | Yes |
| AWS Certificate Manager | Required | — | — | — |
| DigiCert | Required | — | — | Yes |
| GlobalSign | Required | — | — | — |
| GoDaddy | Required | — | — | Yes |
| Google Trust Services | Required | — | — | Yes |
| Sectigo | Required | — | — | Yes |
| SSL.com (ECC certificates) | Required | — | — | — |
| SSL.com (RSA certificates) | Required | — | — | — |
| ZeroSSL | Required | — | — | — |
DigiCert, GoDaddy, and Sectigo require you to buy a certificate order from the CA before CertKit can issue against it.
AWS Certificate Manager validates domains on your ACME endpoint in the AWS console, so its certificates need no CNAME in CertKit. Each endpoint has its own directory URL, which you enter along with the EAB credentials.
SSL.com runs separate ACME directories for ECC and RSA certificates, so CertKit lists them as two issuers. Each one only accepts certificates with its own key type.
Adding an Issuer
Adding an issuer requires a Friendly Name, Account Email, EAB Key ID, and EAB HMAC. The process for generating EAB credentials varies by vendor.