Advanced Automation

Most environments should rely on default auto-detection after completing Get Started and Renewals. The topics in this section are for when you need explicit control over how DigiCert classifies an ACME request—or when you need to understand why a request became a new billable order.

Use advanced settings sparingly. Incorrect automation actions can create unexpected new orders or interrupt renewal tracking.

Acronyms used on this page

Term	Meaning
ACME	Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU	ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
ARI	ACME Renewal Information — optional CA-directed schedule for when to renew a certificate
CN	Common Name — primary hostname on the certificate (`--cn` flag)
SAN	Subject Alternative Name — additional hostnames on the same certificate (`--sans` flag)

Two different mechanisms. ARI (see Renewals) drives automatic reissues in the background—you do not run enroll again. Auto-detection applies when you submit a new certificate request (manual re-enroll, migration, or forced actions). This section covers auto-detection and explicit overrides—not ARI configuration.

When to read this section

You need to understand why a request was treated as a reissue, renewal, or new enrollment.
A re-run of dc-acme request enroll created a new billable order when you expected a reissue.
You must force a specific action (enroll, renew, or reissue) via URL parameters or CLI flags.
You are migrating from manual CertCommand workflows to ACME and need predictable behavior during transition.

If none of these apply, you can skip this section until you need it.

In this section

Auto-detection Rules

How DigiCert decides whether an ACME request is a renewal, reissue, or new enrollment—and what changes (such as SAN modifications) can trigger a new order.

Auto-detection Rules »

ACME Automation Actions

How to override auto-detection using action= URL parameters or --cc-order-action CLI flags, and common mistakes to avoid.

ACME Automation Actions »

Key points upfront

The ACME client submits certificate requests; DigiCert classifies each one as reissue, renewal, or new enrollment.
Non-wildcard: CN and SAN list must match exactly—or you get a new billable order. Forced reissue with new --sans does not add names.
Wildcard: Same wildcard CN (*.example.com) can gain or lose SANs.
Only ACME-issued orders are eligible for ACME reissue/renewal matching.
Confirm outcomes in CertCommand (Certificates > Orders) and dc-acme request list.

Next step