How to Use ACME (Certbot, acme.sh) with a Paid SSL Certificate

ACME works with paid certificates, too

Yes, you can use Certbot, acme.sh and other ACME clients with a paid SSL certificate. ACME (Automatic Certificate Management Environment, the protocol defined in RFC 8555) is not tied to Let’s Encrypt. Any certificate authority (CA) can run an ACME server, and several commercial CAs do.

The main difference in an ACME paid SSL certificate setup is one extra step: External Account Binding (EAB). Your CA gives you a key ID and an HMAC key, and your client sends them when it registers. That links the client to your paid account, so the CA knows which plan, products and organization details apply.

After that, the workflow feels the same as with a free CA. The client proves domain control, downloads the certificate, installs it and renews it on a schedule.

Key facts

Item	What it means for you
Protocol	ACME, standardized as RFC 8555 (2019). The same protocol Let’s Encrypt uses.
Account link	External Account Binding: a key ID plus an HMAC key from your CA account.
Common clients	Certbot and acme.sh both support EAB through command-line options.
Validation	DV through HTTP-01 or DNS-01 challenges. OV only where the CA supports it for a pre-validated organization.
Renewal	The client renews on a schedule and can run a hook to reload your web server.

How an ACME paid SSL certificate setup works

An ACME paid SSL certificate setup differs from Let’s Encrypt in three places: the server address, the account binding and the product behind it. Everything else, including the challenge types, stays the same.

Let’s Encrypt free SSL certificates via ACME need no account. Your client simply points at the public Let’s Encrypt directory. A commercial CA instead gives you its own directory URL (the ACME endpoint your client talks to) inside your account, and it only accepts clients that present valid EAB credentials.

Aspect	Free ACME CA (e.g. Let’s Encrypt)	Paid ACME CA
Account	Anonymous key pair	Bound to your CA account with EAB
Directory URL	Public, the client default	Provided in your account; you set it with a flag
Validation levels	DV only	DV; OV on some products
Support	Community forums	CA and reseller support
Billing	None	Plan or subscription with the CA or reseller

Choosing between a free and a paid CA is a separate decision. This page assumes you have chosen a paid product and focuses on the hands-on setup.

What is External Account Binding (EAB)?

External Account Binding is an ACME feature that links a new ACME client account to an existing account at the CA. You receive two values, a key ID (KID) and an HMAC key, and the client uses them once during registration to sign a binding request.

Without EAB, a commercial CA could not tell which customer an ACME request belongs to. With it, every certificate the client orders lands in your account, under your plan and your organization data. EAB is defined in section 7.3.4 of RFC 8555.

Tip: Treat the HMAC key like a password. Do not commit it to a repository or paste it into a ticket. Some providers issue EAB credentials that work only for one registration, so generate a fresh pair for each server or client if your CA asks for it.

Certbot SSL certificate with a paid CA

Certbot works with a paid CA as soon as you pass three options: --server for the CA’s directory URL, --eab-kid for the key ID and --eab-hmac-key for the HMAC key. Without --server, Certbot talks to Let’s Encrypt, because that is its default.

A typical first request with the webroot method looks like this. Replace the placeholders with the values from your account:

sudo certbot certonly --webroot -w /var/www/html \
  -d example.com -d www.example.com \
  --server ACME_DIRECTORY_URL_FROM_YOUR_ACCOUNT \
  --eab-kid YOUR_KEY_ID \
  --eab-hmac-key YOUR_HMAC_KEY \
  -m [email protected] --agree-tos

certonly obtains the certificate without changing your web server configuration. Use the Apache or Nginx plugin instead if you want Certbot to install it as well. For DNS-based validation, use a DNS plugin and --preferred-challenges dns.

acme.sh with EAB

acme.sh registers the account in a separate step. Its default CA is not your paid CA, so always pass --server:

acme.sh --register-account -m [email protected] \
  --server ACME_DIRECTORY_URL_FROM_YOUR_ACCOUNT \
  --eab-kid YOUR_KEY_ID --eab-hmac-key YOUR_HMAC_KEY

acme.sh --issue --server ACME_DIRECTORY_URL_FROM_YOUR_ACCOUNT \
  -d example.com -d www.example.com -w /var/www/html

Then use acme.sh --install-cert with a --reloadcmd so the certificate is copied to its final path and your server reloads after each renewal.

Does ACME work for OV certificates?

Sometimes. Some CAs let ACME issue organization validated (OV) certificates once your organization has been validated in the account in advance; others offer ACME for DV only. Check the product description or ask support before you plan an OV rollout on ACME.

The reason is simple: ACME can prove domain control automatically, but it cannot check business registries or call your phone number. That organization check happens once, outside ACME. As long as the validation is still valid, the CA can attach it to certificates your client orders. Since March 15, 2026, the CA/Browser Forum caps reuse of that organization data at 398 days, so plan for a periodic re-check.

Validation level	What ACME automates	What happens outside ACME
DV	Domain control check and issuance	Nothing
OV (where supported)	Domain control check and issuance	Organization pre-validation in your CA account
EV	Varies by CA; often not offered	Extended checks per the EV Guidelines

How ACME helps with 47-day certificates

ACME turns renewal and domain validation into a scheduled job, so shorter lifetimes stop being a manual workload. Under CA/Browser Forum ballot SC-081, the maximum lifetime of a public TLS certificate is 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029.

Domain validation can also be reused for less time: 200 days as of October 2026, falling to 10 days from 2029. A client that re-proves domain control on every order handles both changes without extra steps. The full schedule and what it means for planning is covered in our guide on how long SSL certificates last.

Newer clients can also use ACME Renewal Information (ARI), published as RFC 9773 in June 2025. With ARI, the CA can suggest when a certificate should be renewed, for example ahead of a planned revocation. Support depends on your CA and client version.

Tip: Prefer DNS-01 validation through a DNS provider API when you run several servers or wildcard names. HTTP-01 needs port 80 open on every server that answers for the domain.

Automate renewal and fix common ACME errors

Renewal is where ACME pays off. Certbot’s renew command reuses the options from the original request and renews certificates that are close to expiry. acme.sh creates a daily cron job at install that checks and renews certificates as needed.

• Confirm the scheduled task exists (systemd timer or cron) on every server.
• Add a deploy hook, such as --deploy-hook "systemctl reload nginx", so the new certificate is actually served.
• Set an alert outside the server, so a broken renewal does not go unnoticed.

Error or symptom	Likely cause	Fix
EAB or account binding rejected	Wrong or already used key ID/HMAC key	Generate new EAB credentials in your account and register again
Certificate issued by the wrong CA	--server missing, client used its default	Re-run the request with your CA’s directory URL
HTTP-01 challenge fails	Port 80 blocked, redirect to another host, or CDN in front	Open port 80 or switch to DNS-01
Order refused	Plan expired or domain not allowed on the product	Check plan status and covered domains with your provider
New certificate not visible	Web server not reloaded	Add a deploy or reload hook

If a certificate already expired, or you are not using ACME yet, follow the manual steps to renew an SSL certificate.

Choosing a product for ACME

For most servers, a DV certificate is the natural fit for ACME, because the whole validation runs inside the protocol. If you only need encryption and a fast, fully automated path, start with domain validated (DV) SSL. The Sectigo ACME Certificate-as-a-Service (DV) and the GeoTrust and RapidSSL Plan + Automate products shown above are designed for automated issuance; confirm the supported domains and clients on each product page.

ACME covers issuance and renewal. Tracking which certificates exist, who owns them and when they expire is the wider job of SSL certificate management.