Set Up Your First ACME Automation

This is the onboarding chapter for ACME automation with GeoCerts. It takes you from zero through credentials, client install, and a safe sandbox validation—before you run your first production certificate request.

Each step below builds on the previous one. Work through them in sequence unless you already have credentials and an installed client.

Acronyms used on this page

Term	Meaning
ACME	Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU	ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
TOML	Tom's Obvious, Minimal Language — the config file format used by `dc-acme.toml`
EAB	External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts
DCV	Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge)
DAC	DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`)
DNS-01	DNS challenge — publish a `_acme-challenge` TXT record to prove domain control
HTTP-01	HTTP challenge — serve a token file on port 80 at `/.well-known/acme-challenge/`

New to ACME? Create a Sandbox ACME Directory URL in step 1 first. Sandbox requests are not billed, issue short-lived test certificates, and let you prove EAB authentication, DCV, and deployment before production. See Sandbox ACME Directory URL.

IP address certificates. GeoCerts ACME automation supports FQDN identifiers only—--cn and --sans must be domain names, not IP addresses. IP address certificates are not supported through ACME at this time. Issue and renew IP certificates through your existing CertCommand workflow. See Can I use ACME for IP address certificates?

The recommended path

1. Create an ACME Directory URL

Generate the ACME Directory URL and EAB credentials in CertCommand. These define which certificate products can be automated and authenticate your client to GeoCerts.

For first-time setup, use a sandbox URL to validate DCV and client configuration, then create a production URL when you are ready to go live.

Create an ACME Directory URL »

2. Install the DigiCert ACME Client

Install the client on the server where certificates will be issued and confirm the background service is running. You need the client in place before running a sandbox walkthrough or a production request.

Install the DigiCert ACME Client »

3. Validate with a sandbox walkthrough (optional, but highly encouraged)

After steps 1 and 2, we strongly recommend running one of these platform guides before your first production request. Each walkthrough uses a sandbox ACME Directory URL and walks through full end-to-end validation—EAB authentication, DCV, and certificate installation—with real commands and sample output.

Choose the walkthrough that matches your server:

Sandbox Walkthrough (Linux) — DNS-01 (Route 53 example) and NGINX install
Sandbox Walkthrough (Windows/IIS) — DNS-01 (Route 53 example) and IIS install

Skip this step only if you have already completed a successful sandbox validation on the same platform and credentials.

After Get Started

When sandbox validation succeeds (or you are confident in your setup), move to production. You can run enrolls with CLI flags only or with dc-acme.toml—pick the approach that fits your team:

Production CLI Examples — All settings on the command line; good for first production proof and transparent troubleshooting.
Configuration (dc-acme.toml) — Store credentials, handlers, and [service] renewal settings in a file; copy the same config across servers and use shorter enroll commands with --use-default-config.
Understanding Automated Renewals — How renewal timing works and what dc-acme request list does and does not show.

Many teams prove issuance with a CLI example, then adopt a config file for repeat enrolls—you can also start with TOML if you already know your stack and DCV method.

Certificate Automation (ACME) — Full section overview
Production CLI Examples — Production request recipes
Troubleshooting & FAQs — If setup fails

← Back to Certificate Automation (ACME)