Automate SSL certificate issuance, installation and renewal with Sectigo ACME CaaS.

Sectigo ACME Certificate-as-a-Service (CaaS) provides a modern, automated approach to SSL/TLS certificate management. Instead of manually ordering and replacing certificates every time they expire, CaaS uses the ACME protocol to automatically issue, deploy and renew certificates for your subscribed domains.

Designed for websites, servers, cloud environments and modern infrastructure, Sectigo ACME CaaS helps eliminate certificate expiration problems while preparing your infrastructure for the transition toward increasingly shorter SSL/TLS certificate lifetimes.

Subscribe once, automate certificate management and let ACME handle renewals.

Automated SSL Certificate Management with Sectigo ACME CaaS

Managing SSL certificates manually is becoming increasingly impractical. Certificate lifetimes are getting shorter, which means certificates must be replaced more frequently.

Sectigo Certificate-as-a-Service (CaaS) solves this problem by combining commercial Sectigo SSL certificates with the ACME (Automated Certificate Management Environment) protocol.

Once your ACME client has been configured, certificates can be requested and renewed automatically without repeating the traditional manual ordering, CSR submission, validation and installation process every time a certificate approaches expiration.

The result is a simpler and more scalable SSL lifecycle: configure the automation once and let your server manage certificate renewals automatically.

How Sectigo ACME CaaS works

Sectigo CaaS uses a domain subscription model rather than the traditional approach of purchasing each individual certificate.

You subscribe to the domains you want to protect and configure a compatible ACME client using the credentials provided for the service.

The ACME client can then communicate directly with Sectigo’s certificate infrastructure to request and manage certificates for the authorised domains.

Certificates issued through CaaS have a short validity period and are designed to be renewed automatically. During an active subscription, new certificates can be issued for the subscribed domains as required by your ACME client.

This makes CaaS particularly suitable for modern environments where certificate lifecycle automation is essential.

Why choose Sectigo ACME Certificate-as-a-Service?

Fully automated SSL lifecycle

Reduce repetitive manual work. ACME can automate certificate issuance, validation, renewal and deployment, dramatically simplifying day-to-day SSL management.

Prevent unexpected certificate expiration

Expired SSL certificates can result in browser security warnings and service interruptions. Automated renewal allows your ACME client to replace certificates before they expire.

Ready for shorter SSL certificate lifetimes

Public SSL/TLS certificate lifetimes are becoming progressively shorter. A process that was manageable when certificates lasted approximately one year becomes much more difficult when certificates must be replaced every few weeks.

ACME automation makes short-lived certificates practical because renewal becomes a routine machine-to-machine process rather than a recurring administrative task.

Subscription-based certificate management

With CaaS, certificate management revolves around the domain subscription, rather than individual certificate purchases.

During the subscription period, your ACME environment can request the certificates required for the subscribed domains without having to manually purchase a new certificate every time the previous certificate needs replacing.

Commercial SSL backed by Sectigo

CaaS combines the convenience of the ACME protocol with certificates issued by Sectigo, one of the world’s established commercial Certificate Authorities.

Compatible servers and environments

Sectigo ACME CaaS can be used with environments supporting an ACME-compatible client, making it suitable for a wide range of infrastructures.

Typical applications include:

• Apache HTTP Server
• NGINX
• Microsoft IIS
• LiteSpeed
• Caddy
• VPS and dedicated servers
• Cloud servers and virtual machines
• Docker environments
• Kubernetes
• Web hosting platforms
• Custom applications and infrastructure

ACME libraries and clients are also available for many common development environments and programming languages.

Standard and Wildcard domain protection

Sectigo ACME CaaS can be configured to protect both standard domains and wildcard domains.

A standard domain subscription can be used to secure a specific domain or hostname, while a wildcard subscription can protect the main domain together with its first-level subdomains.

Wildcard certificates are particularly useful for infrastructures hosting multiple services such as:

www.example.com
mail.example.com
shop.example.com
portal.example.com

under the same domain.

Domain validation with ACME

Domain ownership can be validated automatically using standard ACME validation mechanisms, including:

HTTP-01 validation – validation is performed by placing a temporary verification resource on the web server.

DNS-01 validation – validation is performed through a DNS record, making it particularly useful for wildcard certificates and fully automated environments.

The available automation level depends on the ACME client and infrastructure being used.

Built for the future of SSL/TLS

SSL certificate management is changing.

As publicly trusted TLS certificate lifetimes become shorter, manually requesting, validating, downloading and installing certificates becomes increasingly inefficient.

Automation changes the model completely.

Instead of treating certificate expiration as an event requiring administrator intervention, ACME allows certificate replacement to become a routine automated process performed by the server itself.

Sectigo ACME CaaS is designed precisely for this new SSL lifecycle.

Key Features

• Sectigo Domain Validated (DV) SSL certificates
• Automated certificate issuance
• Automated certificate renewal
• Automated deployment with compatible ACME clients
• ACME protocol support
• HTTP-01 and DNS-01 domain validation
• Standard domain support
• Wildcard domain support
• Multi-domain/SAN capability
• Up to 256-bit encryption
• Fast automated validation
• Compatible with popular web servers and cloud platforms
• Suitable for servers, VPS, cloud and containerized environments
• Subscription-based certificate management
• Designed for short-lived SSL/TLS certificates
• Sectigo commercial Certificate Authority

Who is Sectigo ACME CaaS for?

Sectigo ACME Certificate-as-a-Service is ideal for system administrators, developers, hosting providers, businesses and organizations that want to eliminate repetitive SSL certificate management.

It is particularly useful when you manage:

• multiple websites or domains;
• VPS or dedicated servers;
• cloud infrastructure;
• web hosting environments;
• containers or Kubernetes deployments;
• services that require reliable, unattended SSL renewal.

If manually replacing certificates every few months — and soon potentially every few weeks — sounds like something you would rather avoid, ACME automation is the natural solution.

Sectigo ACME CaaS vs traditional SSL certificates

Frequently Asked Questions

What is Sectigo Certificate-as-a-Service (CaaS)?

Sectigo CaaS is a subscription-based certificate service that uses the ACME protocol to automate SSL/TLS certificate issuance and lifecycle management for subscribed domains.

What is ACME?

ACME stands for Automated Certificate Management Environment. It is an open protocol designed to automate interactions between servers and Certificate Authorities, including certificate requests, domain validation and renewal.

Do I need an ACME client?

Yes. Your server or infrastructure needs a compatible ACME client capable of communicating with the Sectigo ACME service.

Are certificates renewed automatically?

Yes. Once the ACME environment has been correctly configured, certificates can be automatically renewed before expiration without manually ordering and installing each replacement certificate.

Can I use Sectigo ACME CaaS with wildcard domains?

Yes. Wildcard domain subscriptions are available and are particularly suitable for protecting multiple subdomains belonging to the same domain.

Does it support multi-domain certificates?

Yes. Multiple standard and wildcard domains can be included according to the configuration of the service.

How long are certificates issued through CaaS valid?

Certificates issued through Sectigo CaaS are designed as short-lived certificates. The current Sectigo CaaS documentation specifies a maximum default certificate duration of 90 days. The ACME client automatically requests replacement certificates as required during the active subscription.

What happens when the individual certificate expires?

Normally, nothing requires manual intervention. A correctly configured ACME client requests and deploys a replacement certificate before the existing certificate expires.

The important date to manage therefore becomes the CaaS subscription expiration, rather than the expiration date of every individual certificate.

Is Sectigo ACME CaaS suitable for the upcoming shorter SSL certificate lifetimes?

Yes. Certificate automation is specifically designed to make short certificate lifetimes manageable. As SSL/TLS validity periods decrease, automated issuance and renewal remove the need for administrators to manually replace certificates each time.