Automate SSL/TLS Certificate Management with ACME

CentralNic Reseller will support the Automated Certificate Management Environment (ACME) from October 5, 2026, enabling you to automate the issuance and renewal of Sectigo Domain Validation (DV) SSL/TLS certificates.

You Pay for Certificate Coverage, Not Individual Certificates

The service uses a domain-subscription model. You subscribe the domain names that need certificate coverage, then issue and renew certificates for those domains without a separate charge for each certificate.

Why use ACME?

Public SSL/TLS certificates are becoming shorter-lived. The maximum permitted certificate lifetime is reducing in stages (see SSL/TLS Certificate Lifetime Reduction for the full industry-wide schedule):

• 200 days currently
• 100 days from March 15, 2027
• 47 days from March 15, 2029

Shorter certificate lifetimes improve security but make manual certificate tracking, validation, installation, and renewal increasingly difficult.

ACME is an open, widely supported standard that automates these tasks and reduces the risk of service disruption caused by expired certificates.

What will CentralNic Reseller ACME provide?

• Automated issuance and renewal of Sectigo DV certificates
• Support for standard and wildcard domain names
• One-, two-, or three-year subscription terms
• Unlimited certificate issuance and renewal for subscribed domains
• Compatibility with widely used ACME clients
• API-based account, domain, and subscription management

Certificates issued through the service will have a maximum validity of 90 days. Your ACME client can renew them automatically while the domain subscription remains active.

This service is separate from SSL API 2.0 and uses its own APIs and pricing.

Certificate coverage and domain subscriptions

Two types of domain coverage are available:

• Standard DV domain: Certificate coverage for a specific fully qualified domain name, such as shop.example.com.
• Wildcard DV domain: Certificate coverage using a wildcard, such as *.example.com.

Before you begin

You will need:

• An active CentralNic Reseller account with sufficient account balance
• Acceptance of the applicable SSL product appendix
• A compatible ACME client
• API access to pre-register and manage the ACME account

Common ACME clients include:

Environment	Client
Linux or general server automation	Certbot, acme.sh, Lego
Windows / IIS	win‑acme, Certify The Web, Posh‑ACME
Kubernetes	cert-manager, Traefik, Caddy
CI/CD, containers, cloud workflows	Lego, acme.sh
Private/internal CA automation	step CLI (Smallstep)

How subscriptions work

1. Pre-register an ACME account

   • Pre-register the account through the CentralNic Reseller ACME API and select a subscription term of one, two, or three years.
   • There is no charge for pre-registration. The subscription does not begin until you add the first domain.

2. Register your ACME client

   Register the pre-registered account with your chosen ACME client. This binds the client to the CentralNic Reseller ACME account and allows it to communicate with the ACME service. Follow the CentralNic Reseller API documentation (see ACME section) and your ACME client’s instructions to complete the registration.

3. Add the certificate coverage

   Use the CentralNic Reseller ACME API to add the standard or wildcard domain names for which certificates will be issued.

   When the first domain is added:

   • The subscription starts immediately.
   • The subscription expiration date is calculated using the selected term.
   • The applicable domain fee is deducted from your account balance immediately.

   You can add more standard or wildcard domains during the subscription.

   Every additional domain:

   • Is charged on a pro-rata daily basis for the remaining full days in the subscription. It inherits the subscription’s existing expiration date.
   • Does not restart or extend the subscription term.

4. Issuing and renewing certificates

   Once the relevant domain name has been added, use your ACME client to request a Sectigo DV certificate.

   Depending on the client and environment, the ACME client can:

   • Request a DV certificate for a subscribed domain
   • Complete supported domain validation
   • Install the issued certificate, depending on the client and environment
   • Renew the certificate automatically before it expires

   The subscription must remain active for certificates to continue being issued and renewed.

   There is no per-certificate charge for issuance or renewal.

5. Extending a subscription

   A subscription can be extended when:

   • It contains at least one domain.
   • The request is made between 100 days before expiration and 30 days after expiration.
   • The maximum subscription term is 3 years.

   When you extend a subscription:

   • The selected duration is added to the existing expiration date.
   • Every active domain is extended to the new expiration date.
   • The applicable daily fee for every active domain is deducted immediately for the extension period.

Pricing

• There is no ACME account setup fee or an annual account fee.
• Charges apply to the standard and wildcard domains added to the subscription. Prices are calculated in US dollars on a daily basis.
• The amount shown and charged is converted into the currency configured for your CentralNic Reseller account.
• While a domain subscription is active, there is no separate charge for each certificate issued or renewed for that domain.

Related domain coverage

Some related domain names can be added without an additional charge. Eligibility depends on the type of domain and the order in which the names are added.

Domain added first	Domain added later	Additional charge?
example.com	www.example.com	No
*.example.com	example.com	No
*.shop.example.com	example.com	Yes
*.shop.example.com	www.shop.example.com	Yes
www.example.com	example.com	Yes
example.com	*.example.com	Yes

For information about submitting multiple names in a single request, refer to the CentralNic Reseller ACME API documentation.

Subscription expiration and grace period

A subscription has a 30-day grace period after its expiration date.

During the grace period, you can extend the subscription or remove domains, provided the ACME account remains active.

If the subscription is not extended before the grace period ends:

• The subscription expires.
• Certificates can no longer be issued or renewed under that subscription.
• The domains must be added to a new subscription before certificate automation can resume.

Removing a domain from ACME certificate subscription

You can remove a standard or wildcard domain name from an ACME certificate subscription while the subscription is active or during its grace period.

Removing Certificate Coverage Does Not Affect the Domain Registration

Removing a domain from an ACME subscription stops certificate issuance and renewal for that name. It does not cancel or transfer the domain registration, change its DNS configuration, or affect its ownership.

The ACME account must be active. A domain name cannot be removed from the certificate subscription while the account is suspended or deactivated. If the account is suspended, restore it before attempting the removal.

Removing associated certificate coverage

Some domain names can be included without an additional charge because they are associated with a paid name.

The Following Rules Apply

• Removing a paid name also removes the certificate coverage associated with any related name that was included at no additional charge.
• Removing a related name that was included at no additional charge does not remove the paid name.

For example, if certificate coverage for www.example.com was included at no additional charge because example.com was already subscribed, removing example.com from the ACME subscription will also remove the associated coverage for www.example.com.

Refunds

A domain removed within 30 days of being added may qualify for a full refund of the amount charged for that domain-addition transaction.

Refund eligibility is subject to confirmation by the certificate authority. Refunds must initially be requested through CentralNic Reseller and will be processed manually.

Contact your account manager or CentralNic Reseller Support with the relevant ACME account and domain details.

Domains removed after 30 days do not qualify for this refund.

Initial service limitations

When the service becomes available on October 5, 2026:

• Only Sectigo DV certificates will be available.
• The standalone domain subscription model will be supported.
• ACME management will be available through the API.
• Control panel management will not yet be available.
• Refund requests will be handled manually.