Production CLI Examples

These pages show production certificate requests using the DigiCert ACME Client with command-line flags only. Do not pass --use-default-config on these examples—the client will not read dc-acme.toml.

Acronyms used on this page

Term	Meaning
ACME	Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU	ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
CLI	Command-Line Interface — run `dc-acme request enroll` with explicit flags instead of loading settings from `dc-acme.toml`
TOML	Tom's Obvious, Minimal Language — the config file format used by `dc-acme.toml`
EAB	External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts
DCV	Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge)
DAC	DigiCert ACME Client — GeoCerts' recommended ACME client (`dc-acme`)
ARI	ACME Renewal Information — optional CA-directed schedule for when to renew a certificate
DNS-01	DNS challenge — publish a `_acme-challenge` TXT record to prove domain control
HTTP-01	HTTP challenge — serve a token file on port 80 at `/.well-known/acme-challenge/`

New to ACME? Complete Get Started first: create an ACME Directory URL, install the client, and run a sandbox walkthrough before production. If a request fails, see Verify and Diagnose ACME Requests.

Every production enroll needs

Pass these on every dc-acme request enroll command, regardless of which example you follow:

Flag	Purpose
`--directory-url`	GeoCerts ACME directory endpoint (same URL for sandbox and production)
`--email`	Contact email for the ACME account
`--eab-key` / `--eab-hmac`	EAB credentials from your production ACME Directory URL in CertCommand
`--cn`	Common Name for the certificate—a domain name (FQDN), not an IP address (not stored in `dc-acme.toml`)
`--auto-ari-renew=true`	Registers automatic CA-directed reissues and renewals for this certificate (ACME Renewal Information)—the expected default for production automation

Also set both challenge flags explicitly—for DNS-01, --challenge-type "dns-01" and --challenge-handler-name "default". Omitting --challenge-type defaults to HTTP-01 with the standalone handler, which is a common first-request failure.

IP address certificates. GeoCerts ACME automation supports FQDN identifiers only—--cn and --sans must be domain names, not IP addresses. IP address certificates are not supported through ACME at this time. Issue and renew IP certificates through your existing CertCommand workflow. See Can I use ACME for IP address certificates?

Automatic reissues (--auto-ari-renew). ACME Renewal Information (ARI) is the recommended production model—DigiCert tells the client when to reissue, adapting as lifetimes shrink. On CLI-only enrolls, omitting --auto-ari-renew registers an ARI job; pass --auto-ari-renew=false for sandbox one-shot enrolls. Examples pass --auto-ari-renew=true for clarity (no --use-default-config).

dc-acme --defaults and --help report Auto ARI Renew: false — that does not match CLI-only enroll behavior. For config-based production enrolls, set TOML auto_ari_renew = true and use --use-default-config; CLI --auto-ari-renew does not override TOML. Confirm acmeAriId in request list. Read What is ARI?

For config-based enroll—shorter commands, shared settings across servers, secrets off the CLI—see Configuration (dc-acme.toml). Set auto_ari_renew = true in TOML and enroll with --use-default-config; confirm non-zero acmeAriId in request list.

Examples by stack and DCV method

Web server + validation method

Example	Platform	DCV	Install
NGINX with DNS-01	Linux	DNS-01 (Route 53)	NGINX
NGINX with HTTP-01	Linux	HTTP-01	NGINX
IIS with HTTP-01	Windows	HTTP-01	IIS

More stack-specific examples (Apache, IIS with DNS-01, issue-without-install) will be added here over time.

Certificate shape

Example	Use when
Wildcard certificates	You need `*.example.com` (DNS-01 required)
Subject Alternative Names (SANs)	You need additional hostnames on one certificate

After a successful production request

Confirm COMPLETED in dc-acme request list and the order in CertCommand under Certificates > Orders.
Verify HTTPS is live on your web server.
Optional: Adopt dc-acme.toml for future requests on this or other servers—your first certificate already registered ARI when you passed --auto-ari-renew=true.
Read Understanding Automated Renewals for how the background service renews certificates.

If something fails, see Verify and Diagnose ACME Requests.

Get Started — ADU, install, sandbox walkthroughs
Configuration (dc-acme.toml) — Config-based enroll alternative to all-CLI flags
Verify and Diagnose ACME Requests — EAB, DCV, and install failures
Troubleshooting Common Issues — Funding, OV, and permissions

← Back to Certificate Automation (ACME)