Alternative ACME Clients
GeoCerts recommends the DigiCert ACME Client (DAC) for ACME automation with CertCommand. It is developed by DigiCert, supports External Account Binding (EAB) natively, runs a background service for renewal monitoring, and supports ACME Renewal Information (ARI)—the recommended production renewal path.
The guides in this section are for customers who already use third-party ACME clients and need platform-specific examples with GeoCerts ACME Directory URLs.
Acronyms used on this page
| Term | Meaning |
|---|---|
| ACME | Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal |
| ADU | ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs |
| EAB | External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts |
| DCV | Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge) |
| MPIC | Multi-Perspective Issuance Correlation — DigiCert validates DCV from multiple global network locations See SSL Domain Validation (DCV) Rules Have Changed. |
| DAC | DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`) |
| ARI | ACME Renewal Information — optional CA-directed schedule for when to renew a certificate |
Starting fresh? Use Get Started and the Production CLI Examples instead of Certbot or Win-ACME. DAC is the path we document first because it matches DigiCert's supported automation model.
When to read this section
- You already run Certbot on Linux with NGINX or Win-ACME on Windows with IIS.
- You need to map CertCommand EAB credentials and the ACME Directory URL to a third-party client’s option names.
- You are comparing third-party renewal behavior with DAC’s background service and ARI.
If you are planning a new deployment, start with Get Started instead.
In this section
Example: Certbot with NGINX (HTTP-01)
Obtain and install a certificate on Linux using Certbot’s NGINX plugin, EAB flags, and the GeoCerts ACME Directory URL.
Certbot with NGINX (HTTP-01) »
DAC equivalent: NGINX with HTTP-01 (Linux)
Example: Win-ACME with IIS (HTTP-01)
Interactive Win-ACME setup on Windows Server with IIS, HTTP-01 validation, and EAB credentials from CertCommand.
DAC equivalent: IIS with HTTP-01 (Windows)
Key points upfront
- Any EAB-capable ACME client can use your CertCommand ACME Directory URL—option names differ (
--serverin Certbot,--baseuriin Win-ACME,--directory-urlin DAC). See Create an ACME Directory URL. - Third-party clients schedule renewals locally (systemd timer, scheduled task). Certbot (4.1.0+) and Win-ACME can query ARI when their renew job runs if the directory supports it—but they do not use DAC’s
DigicertAcmeClientbackground service, do not showacmeAriIdindc-acme request list, and respond on a timer schedule rather than continuously. DAC with ARI remains the recommended production renewal path. - DigiCert still applies auto-detection rules on every certificate request—changing CN or SANs on a non-wildcard order can create a new billable order even when your client calls it a “renewal.”
- Confirm outcomes in CertCommand (Certificates > Orders), not only in the client’s local renewal logs.
Related topics
- Get Started with DigiCert ACME Client — Recommended primary path
- Create an ACME Directory URL — EAB credentials and client option mapping
- Understanding Automated Renewals — ARI and DAC background renewals
- Troubleshooting Common Issues — DCV, EAB, and unexpected new orders
← Back to Certificate Automation (ACME)