Install the DigiCert ACME Client

After creating your ACME Directory URL, install the DigiCert ACME Client (DAC) on the system where certificates will be requested and deployed.

What it is — and why GeoCerts recommends it

The DigiCert ACME Client is DigiCert’s official ACME client for requesting, installing, and renewing certificates against DigiCert ACME Directory URLs—including the GeoCerts CertCommand URLs you create for DigiCert and GeoTrust products. It is the client GeoCerts documents first for ACME automation.

Why we prefer it:

  • Built for DigiCert and GeoTrust — Designed for DigiCert’s ACME backend, certificate products, and External Account Binding (EAB). You get a path that matches how DigiCert expects automation to work with GeoCerts ACME Directory URLs.
  • One CLI for Linux and Windows — The same dc-acme commands work on both platforms. You do not need one client for Linux and another for Windows.
  • Vendor support — DigiCert develops and supports the client. Other ACME clients are often community-supported only.
  • Service-based renewals — After install, the client runs as a background service (DigicertAcmeClient) so automated renewals do not depend on ad-hoc cron or Task Scheduler jobs when automation is enabled.

Third-party clients such as Certbot and Win-ACME can work with GeoCerts ACME Directory URLs. If you already standardize on one of those, see Alternative ACME Clients.

Acronyms used on this page

Term Meaning
ACME Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
TOML Tom's Obvious, Minimal Language — the config file format used by `dc-acme.toml`
DAC DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`)
CLI Command-Line Interface — run `dc-acme request enroll` with explicit flags instead of loading settings from `dc-acme.toml`
EAB External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts

Supported platforms

  • Linux (systemd-based distributions)
  • Windows Server and Windows Desktop

Once installed, the client runs as a managed service. You do not need cron jobs or scheduled tasks for renewals when automation is enabled in configuration.

Install on Linux

Run the following command to download and install the DigiCert ACME Client:

curl "https://automation-service.digicert.com/dc-acme/linux/install.sh" | sudo bash

This command:

  • Downloads the DigiCert ACME Client
  • Installs the required binaries
  • Registers and starts the DigicertAcmeClient service

After installation, the dc-acme command is available on the system.

Install on Windows

  1. Open PowerShell as Administrator.
  2. Run:
iex ((New-Object System.Net.WebClient).DownloadString('https://automation-service.digicert.com/dc-acme/windows/install.ps1')); Install-DigicertAcmeClient

This downloads the installer and registers the client as a Windows service.

Configuration file location

The DigiCert ACME Client stores settings in dc-acme.toml:

  • Linux: /var/digicert/acme-client/config/dc-acme.toml
  • Windows: C:\Program Files\DigiCert\AcmeClient\config\dc-acme.toml

You do not need to edit this file before your first production request. Use Production CLI Examples for all-CLI enrolls, or populate the file and use --use-default-config as described in Configuration (dc-acme.toml)—either approach works.

Verify the service is running

Linux

sudo systemctl status DigicertAcmeClient

You should see the service in an active (running) state.

To start, stop, or restart:

sudo systemctl start DigicertAcmeClient
sudo systemctl stop DigicertAcmeClient
sudo systemctl restart DigicertAcmeClient

Windows

Get-Service -Name "DigicertAcmeClient"

To start, stop, or restart:

Start-Service -Name "DigicertAcmeClient"
Stop-Service -Name "DigicertAcmeClient"
Restart-Service -Name "DigicertAcmeClient"

Next step

With the service running, validate end-to-end with a sandbox URL before you create production orders:

When sandbox validation succeeds, move to Production CLI Examples for your web server and DCV method.

← Back to Get Started