SSL automation: certificates that renew themselves

The CloudHosting ACME subscription works with any client that implements RFC 8555, the ACME v2 standard, and supports External Account Binding: certbot, acme.sh, Caddy, Traefik, cert-manager and win-acme are all proven choices. There is no proprietary agent to install, because the subscription speaks the standard protocol these tools already understand. In practice you pick the client that matches your stack, for example certbot on a classic Linux server, Caddy or Traefik when the web server handles certificates itself, cert-manager in container clusters and win-acme on Windows. If you are unsure whether your client supports EAB, check its documentation or write to our support before ordering.

A CloudHosting ACME subscription costs 17.63 EUR a year per domain without VAT and includes 1 SAN. That single flat fee covers the protocol activity itself: your client can issue, reissue and renew certificates as often as its schedule requires, and none of those operations costs anything extra. If the setup grows, you extend the same subscription with additional hostname SANs or wildcard SANs, up to 255 in total; each add-on has its own annual price shown in the catalog on this page. So the yearly total is simply the base fee plus the add-ons you actually use, with nothing metered and no surprises at renewal time.

The CloudHosting ACME subscription issues wildcard entries such as *.example.com through the DNS-01 challenge, which ACME requires for every wildcard. A wildcard entry covers every hostname on one level under the domain, so new subdomains are protected without touching the certificate. To prove control, your client publishes a temporary TXT record in the domain zone, and the certificate authority checks that record before issuing. Most clients automate this step with plugins for popular DNS providers, so renewals also run unattended. The practical requirement: your DNS provider must offer an API the client can use to add the record automatically. If yours does not, ask our support about workable setups before you order.

CloudHosting delivers every ACME subscription with an External Account Binding pair, a key ID called kid and an HMAC key, sent by email after the order. EAB is the mechanism that ties an ACME account to your paid subscription: your client presents the pair once, when it registers its ACME account, and from then on every certificate request runs under your subscription with its authorization. Without EAB anyone who knew the server address could issue certificates at your expense, which is exactly what this prevents. Treat the pair like a password: store it securely in your configuration, keep it out of public repositories, and if you suspect it has leaked, contact our support.

The CloudHosting ACME subscription uses the same ACME v2 protocol as Let's Encrypt, so the clients, commands and cron jobs you already know work unchanged: you only point them at the Sectigo directory URL and add the EAB pair. What the paid subscription adds is a longer certificate lifetime, up to 199 days against 90 days or less at Let's Encrypt, so renewals are rarer and an automation fault leaves a wider safety margin. It also allows up to 255 SANs on one certificate instead of 100, gives you a second, commercial certificate authority if you do not want to depend on one free service, and comes with a support team you can write to when something in the pipeline misbehaves.

A CloudHosting ACME subscription is scoped to one registered domain, with 1 SAN included and room for up to 255. Everything under that domain can live on the same certificate: hostnames like www, mail or api are added as individual SANs, and a wildcard SAN covers a whole level of subdomains at once. A separate domain, even one belonging to the same company, needs its own subscription, ordered the same way and delivered with its own directory URL and EAB credentials. In practice your servers can run several ACME configurations side by side, one per domain, and each renews independently. If you manage a larger portfolio of domains, write to our support and we will help plan the structure.

With a CloudHosting ACME subscription the only manual work is a one-time setup, after which your ACME client requests, installs and renews certificates on its own schedule. Install a client such as certbot, acme.sh or Caddy, give it the Sectigo directory URL and your EAB credentials, and tell it which hostnames belong on the certificate. From then on the client requests the certificate, places the files where your web server expects them and reloads the service, then repeats the whole cycle without human action. What we still recommend is an occasional glance at the client logs after configuration changes, since a typo in a new hostname is easier to catch early than at renewal.

A failed renewal on a CloudHosting ACME subscription is not an outage, because the certificate already installed stays valid until its expiry date and ACME clients start renewing well before that date. That usually leaves a window of several weeks in which the site keeps working normally while you investigate. ACME clients also retry automatically on their next scheduled run, so a temporary problem often resolves itself. Typical persistent causes are an expired DNS API token, a changed record or a firewall blocking the client; the client logs show which step failed. If you cannot find the cause, our support helps you debug the setup on working days from 9:00 to 17:00 Riga time.

CloudHosting has two separate answers to renewal: this ACME subscription at 17.63 EUR a year per domain, and chssl, a free agent for the certificates sold on our single-domain, wildcard and multi-domain pages. The ACME subscription gives your own ACME client direct access to Sectigo with EAB credentials, so it can create certificates for any hostnames under your domain on demand, which suits DevOps pipelines, containers and setups that change often. chssl runs on Linux servers with nginx, Apache or Docker and installs each reissue of a certificate you bought from our catalog within its paid term; your TLS private key never leaves the server. If a catalog certificate on a standard web server is all you need, chssl is usually enough.