ACME Automation Actions

ACME automation actions let you explicitly control how DigiCert treats a certificate request—overriding normal auto-detection rules.

Use them sparingly and intentionally. Incorrect actions can create unexpected new orders or break renewal tracking.

Acronyms used on this page

Term	Meaning
ACME	Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU	ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
ARI	ACME Renewal Information — optional CA-directed schedule for when to renew a certificate
CN	Common Name — primary hostname on the certificate (`--cn` flag)
SAN	Subject Alternative Name — additional hostnames on the same certificate (`--sans` flag)

Two ways to specify an action

Method	How	Typical use
URL parameters	Append `?action=…&orderId=…` to the ACME Directory URL passed as `--directory-url`	Persistent override baked into the ADU URL in CertCommand
CLI flags	`--cc-order-id` and `--cc-order-action` on `request enroll`	One-off override without changing the stored ADU URL

Both approaches override auto-detection for that enroll. Invalid action values (for example, action=reissuex) are rejected with an InvalidAction error—they are not silently ignored.

Available actions

Enroll — Force a new certificate order
Renew — Force renewal of an existing ACME-issued order (new prepaid coverage term)
Reissue — Force reissue of an existing ACME-issued order (replacement on the same order)

Each action changes how DigiCert processes the request after it is received.

Force a new enrollment (`action=enroll`)

Use when you intentionally want a new, billable certificate order, even if a matching ACME-issued certificate already exists.

URL parameter — append to your directory URL:

https://one.digicert.com/mpki/api/v1/acme/v2/directory?action=enroll

Pass that full string as --directory-url on enroll.

When to use:

Migrating to a new automation workflow
Separating certificates by environment
Intentionally creating parallel certificates

DigiCert skips auto-detection and always creates a new order. This is the safest explicit action.

Force a renewal (`action=renew`)

Use to explicitly renew an existing ACME-issued certificate order (starts a new prepaid coverage term).

URL parameter:

https://one.digicert.com/mpki/api/v1/acme/v2/directory?action=renew&orderId=123456789

CLI flags (alternative):

sudo dc-acme request enroll \
  --directory-url "https://one.digicert.com/mpki/api/v1/acme/v2/directory" \
  --cc-order-id 123456789 \
  --cc-order-action renew \
  --cn "example.com" \
  ...

Requirements:

The original certificate must have been issued via ACME
The order ID must be valid and visible in CertCommand
Product and scope must still match
The order must be in a renewable state

If conditions are not met, the request may fail or be treated as a new enrollment.

Force a reissue (`action=reissue`)

Use to explicitly reissue an existing ACME-issued certificate (replacement on the same order while prepaid coverage remains).

URL parameter:

https://one.digicert.com/mpki/api/v1/acme/v2/directory?action=reissue&orderId=123456789

CLI flags (alternative):

sudo dc-acme request enroll \
  --directory-url "https://one.digicert.com/mpki/api/v1/acme/v2/directory" \
  --cc-order-id 123456789 \
  --cc-order-action reissue \
  --cn "example.com" \
  ...

--cc-order-id requires --cc-order-action—passing the order ID alone fails.

Typical uses:

Fresh key pair after suspected compromise
Infrastructure change requiring a new certificate file on the same order

Reissue does not add SANs on non-wildcard orders. Passing --sans with a forced reissue on a non-wildcard certificate may succeed, but the new SAN is ignored. To add hostnames, use action=enroll or a normal enroll with the full name list—this creates a new, billable order. See Subject Alternative Names (SANs).

Prefer reissues through the ACME client—not manual reissue in CertCommand—to preserve ACME renewal tracking.

Important limitations

Automation actions:

Apply only to certificates originally issued via ACME
Cannot manage manually issued certificates
May fail or create unexpected orders if the order ID, product, or name set is wrong

Manually issued certificates must be replaced with a new ACME enrollment to enter automation.

When not to use automation actions

Most environments should not use explicit actions during normal operation.

Avoid them when:

Auto-detection already works
ARI handles routine reissues (see Renewals)
You are unsure which order ID to reference

If you are unsure, let DigiCert auto-detect.

Confirm the result

CertCommand — Certificates > Orders shows whether a new order was created or an existing order was renewed/reissued
Local request history:

sudo dc-acme request list

Key takeaways

Override auto-detection via URL parameters or --cc-order-id / --cc-order-action
action=enroll is the safest explicit action
action=renew and action=reissue require a valid order ID and ACME-issued origin
Forced reissue does not add SANs on non-wildcard certificates
ARI handles routine production reissues—actions are for manual/migration scenarios

Next step

Troubleshooting & FAQs »

← Back to Advanced Automation