Actalis ACME automation for EU-issued certificates

An EU certificate authority still can't install anything for you.

Actalis is an Italian certificate authority and a qualified trust service provider, which is why it turns up on shortlists where jurisdiction matters: European organizations, public sector buyers, and anyone whose procurement asks where the trust service is established. It supports ACME with External Account Binding, so issuance automates cleanly.

Deployment does not. The certificate still has to reach every server and appliance that presents it, in that platform's format, and be replaced again on a cycle that keeps getting shorter. CertKit holds your Actalis EAB credentials, renews on schedule, and the CertKit Agent installs each renewal and confirms it is live.

Start free trial Watch demo

Where the certificates live, not just who signs them

If you chose an EU trust service provider deliberately, the next question your own procurement will ask is where everything else sits. A certificate authority established in Italy does not help much if the automation around it holds your private keys somewhere you cannot point to on a map.

CertKit issues and renews centrally, and private keys can stay on infrastructure you operate. The CertKit Keystore, an optional component available on Enterprise plans, holds the keys on your own systems, so what leaves your estate is the certificate request and what comes back is the signed certificate. The agent is source-available, so the code handling keys on your servers can be read rather than trusted.

That distinction is worth getting straight early, because it is the one an auditor returns to. Actalis answers who vouches for the certificate. Where the key material lives and who can reach it is a separate question with a separate answer, and both need one.

Running Actalis ACME on your own

The do-it-yourself version, once you have EAB credentials:

Deploy a client to each host and register it. One ACME account per client against your Actalis account, each holding its own copy of the Key ID and HMAC.
Put your key material wherever the client happens to run. Each client generates and holds its own private keys on whichever machine it is installed on. For an estate chosen partly on jurisdiction, that is a set of decisions being made by default rather than deliberately.
Write post-deploy hooks per platform. Convert the files, put them where the service reads them, update the configuration, reload. Written once per platform, exercised only on renewal.
Handle whatever has no shell. Appliances and load balancers import through an API or a UI that no ACME client speaks.
Monitor the endpoint, not the exit code. Renewals run roughly twelve times a year once 47-day lifetimes arrive. A silent failure has that many chances to happen while nothing reports it.
Keep the record an auditor will ask for. If you chose an EU trust service provider for compliance reasons, the evidence of what was issued and installed matters as much as the CA itself, and per-host logs are a poor place for it to live.

The second and sixth items are the ones that matter most here: key material placed by accident, and a compliance story that only holds up if the deployment record does too.

At 47 days, renewal has to run itself — and prove that it did. Here's how CertKit does both for Actalis.

How it works

    Actalis              CertKit              Your systems
┌──────────────┐   ┌─────────────────┐   ┌──────────────────┐
│              │   │                 │   │                  │
│  ACME  ◄─────────── EAB creds      │   │  ┌─────────────┐ │
│              │   │  (stored once)  │   │  │CertKit Agent│ │
│      │ issues│   │                 │   │  └──────┬──────┘ │
│      ▼       │   │  Track expiry,  │   │         │        │
│  Certificate ───►│  renew early    │   │         ▼        │
│              │   │       │         │   │  nginx    [x]    │
│              │   │       ▼         │   │  Apache   [x]    │
│              │   │  Deploy ───────────►│  appliances [x]  │
└──────────────┘   └─────────────────┘   └──────────────────┘
   EU trust           one CNAME             deployed and
   service provider   delegation              verified

Validation runs through a single delegated CNAME, so renewals never require another DNS change and CertKit never holds credentials for your DNS provider.

Ever since the news of the Certificate expiration dates being compressed down to 47 days we have been looking for an MSP friendly solution, CertKit were the clear winners as their platform is easy to use, MSP friendly & cost effective. We’ve been really impressed with the team from a technical support perspective as they’re super quick to respond and we’ve never had a certificate we couldn’t provision!

Andrew Charlesworth, Technical Director, NCS

What CertKit handles

Renew without anyone watching the calendar. Expiry tracked per certificate, renewed with enough margin that a failed attempt can retry well before the deadline.
Hold EAB credentials centrally. One registration for the account rather than credentials distributed to each host.
Keep private keys on your own infrastructure. The CertKit Keystore, available on Enterprise plans, holds key material on systems you operate, which is the part of the jurisdiction question the CA cannot answer for you.
Install on every platform that serves it. The CertKit Agent covers nginx, Apache, IIS, Linux hosts, and appliances, in each one's native format, restarting or reloading as needed.
Verify the certificate on the wire. A TLS connection after each deployment, checking serial, names, and expiry against what was issued.
Run Actalis next to other issuers. Keep Actalis where EU jurisdiction matters and use another CA elsewhere, from one inventory.
Record every issuance and install. A dated history per certificate, which is the evidence an auditor asks for when jurisdiction is the reason the CA was chosen. At twelve renewals a year, nobody reconstructs that from memory.

Setup takes about ten minutes

Delegate validation with one CNAME. One record per domain, added once, reused by every renewal.
Get your EAB credentials from Actalis. Sign in to your Actalis customer account and choose Manage with ACME. The Key ID (KID) and HMAC key appear in the ACME Credentials section.
Add Actalis as an issuer in CertKit. Enter the key details with a name and contact address, and the issuer is live once it registers.
Put the agent on each target. One install command per system, then choose that platform's deployment template.

See the issuer documentation →

Why jurisdiction is a CA decision, not a tooling one

When an organization picks an EU trust service provider, the reason is usually about where the issuing entity is established and which supervisory regime it answers to. That is a property of the certificate authority. It is not a property of the software that requests certificates, and conflating the two produces odd procurement conversations.

Worth separating clearly: the certificate authority is what your compliance position rests on, and the automation layer is what decides whether renewals happen reliably. They are different jobs with different requirements, and neither one substitutes for the other.

CertKit keeps them separate. Actalis signs the certificates and anchors the compliance story; CertKit makes sure every renewal lands where it should, on time.

Actalis is one issuer among several

Most estates end up with more than one CA, often for exactly this kind of reason. CertKit issues from Actalis alongside GlobalSign, Sectigo, DigiCert, and Let's Encrypt, and from a private CA for internal hostnames and mTLS client certificates. Monitoring spans every issuer from one inventory.

See all integrations

Start automating Actalis certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing