SSL certificates without the manual work

PositiveSSL ACME Certificate-as-a-Service (CaaS) combines the affordable Domain Validated SSL security of PositiveSSL with automated certificate lifecycle management using the industry-standard ACME (Automated Certificate Management Environment) protocol.

Instead of manually requesting, validating, downloading, installing and renewing certificates, your server communicates directly with the Certificate Authority through an ACME client.

Once configured, certificates can be automatically issued, deployed and renewed before expiration.

The result is simple: continuous HTTPS protection with dramatically less certificate administration.

What is Certificate-as-a-Service (CaaS)?

Traditional SSL certificates require administrators to manage a series of recurring tasks: certificate requests, domain validation, installation and renewal.

CaaS changes this model.

Your subscription authorizes specific domains for certificate issuance. An ACME-compatible client running on your server can then automatically request and deploy certificates for those domains throughout the subscription period.

Certificates issued through Sectigo CaaS are short-lived and automatically replaced by the ACME client as necessary. This makes the system particularly well suited to the industry’s transition toward increasingly shorter SSL/TLS certificate lifetimes.

Instead of managing individual certificate expiration dates, you manage the CaaS subscription while ACME manages the certificates.

Fully automated certificate lifecycle

ACME automates the repetitive operations traditionally required to maintain SSL/TLS certificates.

Once your server and ACME client have been configured, PositiveSSL CaaS can automate:

• certificate issuance;
• Domain Control Validation (DCV);
• certificate installation and deployment;
• certificate renewal and replacement;
• certificate revocation.

This greatly reduces the risk of unexpected certificate expiration and the browser security warnings and service interruptions that can result from it.

How does PositiveSSL ACME CaaS work?

Getting started is straightforward:

1. Purchase your PositiveSSL CaaS subscription

The subscription enables ACME certificate issuance for your authorized domain or domains.

2. Install or enable an ACME client

Use an ACME-compatible client on your web server, VPS, cloud instance or other supported infrastructure.

3. Configure your ACME credentials

Configure the ACME client using the server URL and credentials supplied for your subscription.

4. Let ACME handle your certificates

Once configured, the ACME client can automatically request, install and replace certificates without requiring the traditional manual renewal process.

Designed for shorter SSL certificate lifetimes

The SSL/TLS ecosystem is moving towards increasingly shorter certificate validity periods.

With manually managed SSL certificates, shorter lifetimes mean more frequent validation, issuance and installation. With ACME automation, however, certificate replacement simply becomes another automated background operation.

PositiveSSL CaaS therefore provides a future-ready approach to SSL certificate management, allowing your infrastructure to adapt to shorter certificate lifetimes without multiplying the workload for system administrators.

Fast Domain Validation

PositiveSSL CaaS uses Domain Validation (DV), so no company documents or lengthy organization validation procedures are required.

Domain Control Validation can be performed automatically using supported ACME challenge methods, including:

• HTTP-01 validation
• DNS-01 validation

Once domain control has been verified, certificates can be issued within minutes.

Standard and Wildcard domain support

PositiveSSL ACME CaaS can protect both standard domains and wildcard domains.

A standard domain can protect a hostname such as:

example.com

and provides coverage for both the base domain and its www version where applicable.

A Wildcard domain can protect a domain and its first-level subdomains, for example:

*.example.com

making it suitable for infrastructures containing multiple services such as:

www.example.com
mail.example.com
shop.example.com
portal.example.com

Additional domains can also be included as Subject Alternative Names (SANs), allowing a single CaaS subscription to accommodate more complex environments.

Works with your existing infrastructure

PositiveSSL ACME CaaS can be used with a wide range of servers and platforms, provided that a compatible ACME client can be installed and configured.

Typical environments include:

Web servers

• Apache HTTP Server
• NGINX
• Microsoft IIS
• LiteSpeed
• Caddy

Hosting and cloud environments

• VPS and dedicated servers
• AWS EC2 and Lightsail
• Microsoft Azure virtual machines
• Google Cloud Compute
• DigitalOcean
• Linode and other cloud providers

Containers and orchestration

• Docker
• Kubernetes

Hosting control panels

• cPanel, where the required SSH/ACME access is available

Custom applications and environments

ACME libraries and clients are available for numerous development environments, including Go, Python, .NET, PHP and Java.

Strong SSL/TLS encryption

PositiveSSL provides industry-standard SSL/TLS protection with encryption strength up to 256-bit, helping protect information exchanged between your website and its visitors against interception.

Certificates are trusted by virtually all modern desktop and mobile browsers, including Chrome, Firefox, Safari, Edge, Brave and the major browsers available on Android and iOS.

Why choose PositiveSSL ACME CaaS?

PositiveSSL CaaS is particularly suitable when you want the advantages of a commercial Sectigo certificate without the repetitive administration traditionally associated with SSL certificates.

It provides:

• Automatic issuance — certificates are requested by your ACME client when required.
• Automatic renewal — certificates can be replaced before they expire.
• Automatic deployment — no need to manually download and reinstall each replacement certificate.
• Fast DV validation — no organization paperwork is required.
• ACME compatibility — based on the widely adopted ACME standard.
• Wildcard support — protect multiple first-level subdomains when required.
• SAN support — accommodate multiple domains within the same solution.
• Future-ready automation — ideal for increasingly short SSL certificate lifetimes.
• Sectigo trust — certificates are issued within Sectigo’s globally trusted PKI infrastructure.

Product specifications

$50,000 warranty

PositiveSSL certificates include a $50,000 warranty from the Certificate Authority.

The warranty provides protection in the unlikely event that the CA incorrectly issues a certificate to a fraudulent or improperly validated entity, subject to Sectigo’s applicable warranty terms and conditions.

PositiveSSL security with ACME automation

PositiveSSL has long been a popular solution for websites that need straightforward, affordable Domain Validated SSL protection.

PositiveSSL ACME Certificate-as-a-Service brings that same approach to automated certificate management.

Configure ACME once and allow your infrastructure to take care of certificate issuance and renewal automatically — keeping your websites protected while eliminating one more repetitive system administration task.