Certificate Automation (ACME)

ACME (Automated Certificate Management Environment) lets you issue, renew, and manage SSL/TLS certificates automatically—without manual CSR submission or portal workflows for every certificate.

GeoCerts supports ACME through CertCommand. This section walks you through automation using the DigiCert ACME Client (DAC), the recommended client for DigiCert-issued ACME Directory URLs.

Acronyms used on this page

Term Meaning
ACME Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
EAB External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts
DAC DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`)

How this section is organized

  1. Get Started — Create an ACME Directory URL, install the client, and validate with a sandbox walkthrough. Start here for your first ACME automation setup.
  2. Production CLI Examples — Production certificate requests by web server and DCV method, using explicit CLI flags only.
  3. Configuration (dc-acme.toml) — Persistent settings, --use-default-config, precedence, and renewal defaults.
  4. Renewals — Understand how automated renewals work, configure timing, and know what to expect from dc-acme request list.
  5. Advanced Automation — Auto-detection rules and explicit automation actions when you need finer control.
  6. Alternative ACME Clients — Certbot and Win-ACME examples if you already use third-party clients.
  7. Troubleshooting & FAQs — Common issues and answers.

The onboarding path and sandbox guidance live on the Get Started hub—not on this page.

Why the DigiCert ACME Client

The DigiCert ACME Client is designed for DigiCert ACME Directory URLs and GeoCerts automation:

  • One-line install on Linux and Windows
  • Native EAB support without extra flags or workarounds
  • Background service for renewal monitoring
  • Configuration via dc-acme.toml for production use

Third-party clients can work with GeoCerts ACME, but DAC is the path we document first because it matches DigiCert’s supported automation model.

Before you begin

You will need:

  • A GeoCerts CertCommand account (ACME automation is included for all accounts)
  • A domain you control (DNS or HTTP validation ready)
  • Administrative access to the server where certificates will be installed

If you are setting up ACME for the first time, work through Get Started in order. That hub covers credentials, install, and optional Linux and Windows/IIS sandbox walkthroughs.

Get Started with DigiCert ACME Client »