SSL automation at RTR
Realtime Register supports two ways to automate commercial SSL: ACME subscriptions and DigiCert AuthKey.
This guide explains when to use each method, how to set it up and who is responsible for certificate requests and renewals.
Related documentation
Choose your automation method
Choose the method that matches where you want certificate lifecycle actions to run.
ACME availability
ACME is available across the following certificate brands offered by Realtime Register.
How an ACME subscription works
An ACME subscription connects one commercial SSL product and its approved domains to an ACME account.
Realtime Register supplies the subscription and EAB credentials. The partner or customer operates the ACME client.
1. Select the product
Retrieve the available SSL products and select an ACME-enabled product.
Check its validation type, periods, required fields and optional fields.
2. Create the subscription
Submit the customer, product, period, domains and any organization or approver data required by the selected product.
Use quote=true when you want to validate the request and receive a quote before creating the subscription.
The create schema always requires customer, product and period. Other required fields depend on the selected product metadata.
<code>POST /v2/ssl/acme
Content-Type: application/json
{
"customer": "your_customer_handle",
"product": "your_acme_product",
"domainNames": ["example.com", "www.example.com"],
"period": 12,
"autoRenew": true
}
The response contains the subscription ID, directory URL, account key and HMAC key. Store the keys securely.
API reference: Create ACME Subscription.
3. Complete validation
DV products require domain control validation through the ACME client.
OV and EV products also require organization validation. A validation process starts when needed.
While validation is incomplete, the subscription can have the status PENDING_ORGANIZATION_VALIDATION.
Monitor progress through process info.
4. Register the ACME account
Provide the directory URL and EAB credentials to the ACME client operator.
Use the client vendor's documentation for the exact registration command.
<code>certbot register \ --server <ACME_DIRECTORY_URL> \ --eab-kid <EAB_ACCOUNT_KEY> \ --eab-hmac-key <EAB_HMAC_KEY>
5. Request and renew certificates
The ACME client can request certificates for domains included in the subscription.
The ACME client operator configures renewal scheduling and remains responsible for successful certificate deployment.
Manage the ACME subscription
The subscription and the certificates requested through it have separate lifecycles.
Expiry and automatic renewal
- Subscriptions are prepaid and valid until
expiryDate. - At expiry, a subscription is automatically renewed or moved to
SUSPENDED. - A suspended subscription can still be renewed.
- After 30 days, it becomes
REVOKEDand can no longer be renewed. - A subscription deleted within 30 days of creation is refunded automatically.
OV and EV revalidation
A new organization validation starts 30 days before the current validation expires.
If it is not completed in time, certificate requests are blocked until validation is complete.
Update the subscription
You can update domains, organization details, approver details, auto-renew settings and the renewal period when supported by the product.
Domain changes can affect pricing. Use the quote option before confirming a billable update.
Recover or recreate credentials
<code>POST /v2/ssl/acme/{acmeSubscriptionId}/credentials
No request body is required.
- For Sectigo, the existing credentials are returned.
- For other brands, replacement credentials are created and the previous credentials are invalidated.
Update the ACME client immediately when replacement credentials are generated.
DigiCert AuthKey workflow
AuthKey supports immediate issuance for applicable DigiCert products. It is not ACME-based.
Your integration generates an AuthKey, then includes it in the SSL request. Renewals and reissues are also submitted through the SSL lifecycle API.
1. Generate the AuthKey
<code>POST /v2/ssl/authkey
Content-Type: application/json
{
"product": "your_digicert_product",
"csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----"
}
The response contains the authKey and the time until which it is valid.
2. Request the certificate
Submit the certificate request through POST /v2/ssl/certificates and include the generated authKey.
Also supply the fields required by the selected SSL product.
API reference: Request certificate.
<code>POST /v2/ssl/certificates
Content-Type: application/json
{
"customer": "your_customer_handle",
"product": "your_digicert_product",
"period": 12,
"csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
"language": "EN",
"authKey": "your_generated_auth_key"
}
3. Renew a certificate
Submit the renewal through the SSL lifecycle API. Generate and supply a new AuthKey when required by the selected product.
API reference: Renew certificate.
<code>POST /v2/ssl/certificates/{certificateId}/renew
Content-Type: application/json
{
"period": 12,
"csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
"language": "EN",
"authKey": "your_generated_auth_key"
}
4. Reissue a certificate
Submit the reissue through the SSL lifecycle API. Generate and supply a new AuthKey when required by the selected product.
API reference: Reissue certificate.
<code>POST /v2/ssl/certificates/{certificateId}/reissue
Content-Type: application/json
{
"csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
"language": "EN",
"authKey": "your_generated_auth_key"
}
Responsibilities (customer-only)
Common ACME operating models
- Centralized: one platform team operates ACME for multiple systems or customers.
- Distributed: each application or environment operates its own ACME client.
- Deployment pipeline: certificate requests are integrated into CI/CD or configuration management.
- Reseller handover: the reseller creates the subscription and securely provides the credentials to the customer.
Supported ACME clients (examples and references)
Realtime Register supplies the subscription credentials. You can use the ACME client that fits your infrastructure.
- Certbot
- win-acme
- Lego
- Posh-ACME
Use the vendor documentation for installation, account registration and deployment instructions.
Troubleshooting and FAQ
Why is certificate issuance blocked?
Check the subscription status, included domains, credentials and required validations.
If the status is PENDING_ORGANIZATION_VALIDATION, complete the related process before requesting another certificate.
What if the ACME credentials are lost?
Use POST /v2/ssl/acme/{acmeSubscriptionId}/credentials.
Sectigo returns the existing credentials. Other brands generate replacement credentials and invalidate the previous values.
What happens when an ACME subscription expires?
It is automatically renewed or becomes SUSPENDED. A suspended subscription remains renewable for 30 days before becoming REVOKED.
Can I add or remove domains?
Yes, when supported by the product. Domain changes can be billable, so request a quote before confirming the update.
Does importing an existing certificate convert it to ACME?
No. The SSL import endpoint adds an existing certificate to your overview and supports renewal management. It does not convert that certificate into an ACME subscription.
API reference: Import SSL certificate.
<code>POST /v2/ssl/import
Content-Type: application/json
{
"customer": "your_customer_handle",
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}
Does ACME replace DigiCert AuthKey?
No. AuthKey remains available for applicable DigiCert products and integrations that use the SSL lifecycle API.