Requesting a Certificate
Step-by-step guide for ordering certificates using various ACME clients
Ordering the certificate
Make sure you create the DNS record for the domain(s) you are ordering the certificate for.
To order a certificate you will need the credentials you created before. In the examples below, replace the following placeholders with your actual values:
| Placeholder | Value | Where to find it |
|---|---|---|
<YOUR-KID> | Your EAB Key Identifier (KID) | ACME credentials |
<YOUR-SECRET> | Your EAB HMAC Key | ACME credentials |
<SELECTED-SERVER> | The ACME server URL for your product | ACME automation page |
The server URL follows this format: https://acme.networking4all.com/<PRODUCT> where <PRODUCT> is the type of certificate you are ordering.
For example, to order a DV certificate, select dv resulting in https://acme.networking4all.com/dv as the server URL.
If you are using credentials created within the test environment, use https://test-acme.networking4all.com/<PRODUCT> instead.
Using the NGINX plugin (automatically configures your webserver)
certbot --nginx --eab-kid <YOUR-KID> --eab-hmac-key <YOUR-SECRET> --server <SELECTED-SERVER> -d example.com --issuance-timeout 180To use a different plugin, like Apache, simply replace nginx with apache.
Other examples
The first time you order a certificate, Certbot will automatically register an account for your device or server on the ACME server.
This means you only need the --eab-kid and --eab-hmac-key parameters for your very first order from a specific server.
You do not need these parameters on future requests from the same server unless you switch to a different ACME server URL (this includes when you change the <PRODUCT>).
Register an account
./acme.sh --server <SELECTED-SERVER> --eab-kid <YOUR-KID> --eab-hmac-key <YOUR-SECRET> --register-accountOrder the certificate
./acme.sh --server <SELECTED-SERVER> --issue -d example.com -w /var/www/example.com/You can add multiple domains by chaining more after the first one like this: -d example.com -d second.example.com -d third.example.com
Install the certificate
For more information on how to install the certificate on your webserver follow the instructions as mentioned here.
Start the order process using the following command
wacs --accepttos --baseuri <SELECTED-SERVER> --eab-key-identifier <YOUR-KID> --eab-key <YOUR-SECRET> --validation noneThe --validation none flag is required when using the Networking4all ACME server. Without it, simple-acme may attempt validation methods that are not supported.
Choose one of the scenarios below for an indication of the choices you could make. Note that all the choices made are also available as CLI arguments or can be set through the settings.json