Troubleshooting Common Issues

Symptom-based fixes for the most frequent ACME automation problems reported by GeoCerts customers using the DigiCert ACME Client—validation failures, funding, OV delays, permissions, EAB credential loss, and unexpected new billable orders.

For log-driven diagnosis during enroll (EAB, DCV, installation), see Verify and Diagnose ACME Requests. For renewal timing, sandbox behavior, and CLI vs TOML questions, see Frequently Asked Questions.

Acronyms used on this page

Term Meaning
ACME Automated Certificate Management Environment — the protocol used to automate certificate issuance and renewal
ADU ACME Directory URL — the endpoint and credential profile you create in CertCommand under Automation > ACME Directory URLs
CLI Command-Line Interface — run `dc-acme request enroll` with explicit flags instead of loading settings from `dc-acme.toml`
TOML Tom's Obvious, Minimal Language — the config file format used by `dc-acme.toml`
EAB External Account Binding — Key ID and HMAC credentials that authenticate your ACME client to GeoCerts
DCV Domain Control Validation — proof that you control a domain name (via a DNS-01 or HTTP-01 challenge)
MPIC Multi-Perspective Issuance Correlation — DigiCert validates DCV from multiple global network locations See SSL Domain Validation (DCV) Rules Have Changed.
OV Organization Validation — certificate type that also requires a validated organization
SAN Subject Alternative Name — additional hostnames on the same certificate (`--sans` flag)

Domain validation failures

Symptoms: Certificate request stays pending; DCV never completes; ACME client reports validation errors.

Common causes:

  • DNS-01: TXT record missing, wrong host, or slow DNS propagation.
  • HTTP-01: Port 80 blocked, wrong web root, or load balancer not routing /.well-known/acme-challenge/ to the validation host.
  • Wildcard certificates: DNS-01 is required; HTTP-01 will not work.

What to do:

  1. Confirm the validation method matches your environment.
  2. For HTTP-01, ensure DigiCert validation agents can reach port 80 from multiple network locations under MPIC requirements. See SSL Domain Validation (DCV) Rules Have Changed .
  3. Re-run the request after fixing DNS or HTTP configuration.
  4. For OV certificates, confirm domain validation is current in CertCommand under Certificates > Domains.
  5. If you are still setting up ACME, use a Sandbox ACME Directory URL to debug DCV and DNS credentials without production charges or orders.

Account funding or billing issues

Symptoms: Renewal or issuance fails near expiration; orders fail in CertCommand without a clear validation error.

What to do:

  1. Check CertCommand for failed or unpaid orders.
  2. Confirm prepaid coverage or account balance supports a new issuance or renewal.
  3. Resolve billing issues, then allow the client to retry or trigger a manual request if needed.

Account funding or billing issues that prevent certificate issuance can block renewals as well as new requests.

OV validation not current

Symptoms: OV certificate requests hang or fail; instant issuance worked before but not on renewal.

What to do:

  1. Verify the organization is validated under Certificates > Organizations.
  2. Confirm domain validation has not expired for domains on the certificate.
  3. Revalidate organization or domains in CertCommand if reuse periods have lapsed.

For OV certificates, automated issuance and renewal require current organization and domain validation.

Permission and service errors

Symptoms: Permission denied when running dc-acme; service not running; configuration changes ignored.

What to do:

  1. Run dc-acme with appropriate privileges (sudo on Linux, Administrator on Windows).

  2. Confirm the service is running:

    # Confirm DigicertAcmeClient service is running (Linux)
sudo systemctl status DigicertAcmeClient

    # Confirm DigicertAcmeClient service is running (Windows)
Get-Service -Name "DigicertAcmeClient"
  3. Restrict but do not lock down dc-acme.toml so the service account cannot read EAB credentials.
  4. After editing dc-acme.toml, restart the service if changes are not picked up.

Unexpected new orders (instead of free reissues)

Symptoms: An intended “reissue” creates a new billable order; auto-detection did not match the prior certificate.

Common causes:

  • SAN list changed on a non-wildcard certificate (including trying to add names via forced reissue—new --sans values are ignored; a different SAN set on re-enroll creates a new billable order).
  • Certificate was manually reissued outside ACME (breaks ACME renewal tracking).
  • Explicit action=enroll on the ACME Directory URL.

What to do:

  1. Review Auto-detection Rules and Subject Alternative Names (SANs).
  2. Avoid manual reissues in CertCommand for ACME-managed certificates when possible—use the ACME client instead.
  3. Use ACME Automation Actions only when you intentionally need to override detection.

EAB credentials lost or invalid

Symptoms: Authentication errors; client cannot enroll.

What to do:

  1. EAB Key ID and HMAC are shown once at ACME Directory URL creation. They cannot be retrieved later.
  2. Create a new ACME Directory URL in CertCommand and update dc-acme.toml or CLI flags.
  3. Revoke the old ACME Directory URL if credentials may have been exposed.

← Back to Troubleshooting & FAQs