An ACME v2 subscription from Sectigo: your servers request, install and renew trusted SSL certificates automatically. One annual fee per domain, up to 255 SANs, wildcards included via DNS-01.
Flat annual pricing per domain: automation does the rest.
Pick a billing period
No products match your filter.
Prices without VAT; Latvian VAT is 21% where it applies. Prices follow the certificate authorities daily.
From 24 February 2026 a public SSL certificate is issued for up to 199 days, so the file is shorter lived than before. It is a security win: short-lived certificates are much harder to abuse if a key ever leaks. Your multi-year price here does not change and there is no extra cost. At each interval you reissue the certificate yourself in the client panel, which shows how many days are left.
After ordering you receive the directory URL and EAB credentials (kid and HMAC key) by email. One command connects certbot:
certbot certonly \
--server https://acme.sectigo.com/v2/OV \
--eab-kid <your-kid> --eab-hmac-key <your-hmac> \
-d example.com -d www.example.comacme.sh, Caddy, Traefik and any RFC 8555 client work the same way: set the server URL and the EAB pair once, then renewals run on schedule.
The client renews well before expiry. No calendar reminders, no expired-certificate outages.
One subscription covers the domain, extra hostnames and wildcard entries as you grow.
External Account Binding ties issuance to your account, so only your servers can request certificates.
Certificates chain to Sectigo roots trusted by every mainstream browser and OS.
One domain per subscription. The directory URL and EAB kid/HMAC arrive by email.
Point certbot, acme.sh or Caddy at the Sectigo server with your EAB pair. Wildcards validate via DNS-01.
Issuance and renewal run automatically. Add SANs to the subscription whenever the setup grows.
New CA/Browser Forum rules cut the maximum validity of a public SSL certificate step by step, down to just 47 days by 2029.
A 47-day certificate means 8 or more renewals every year, so automation becomes the only practical way to stay secure. On our multi-year plans the price never changes. Today you reissue the certificate yourself in the client panel at each interval; if you want it hands-off, our ACME certificate renews automatically.
Any client that implements RFC 8555, the ACME v2 standard, and supports External Account Binding will work: certbot, acme.sh, Caddy, Traefik, cert-manager and win-acme are all proven choices. There is no proprietary agent to install, because the subscription speaks the standard protocol these tools already understand. In practice you pick the client that matches your stack, for example certbot on a classic Linux server, Caddy or Traefik when the web server handles certificates itself, cert-manager in container clusters and win-acme on Windows. If you are unsure whether your client supports EAB, check its documentation or write to our support before ordering.
A wildcard entry such as *.domain covers every hostname on one level under the domain, so new subdomains are protected without touching the certificate. To issue it, ACME requires the DNS-01 challenge: your client publishes a temporary TXT record in the domain zone to prove that you control the domain, and the certificate authority checks that record before issuing. Most clients automate the whole step with plugins for popular DNS providers, so renewals also run unattended. The practical requirement: your DNS provider must offer an API the client can use to add the record automatically. If yours does not, ask our support about workable setups before you order.
External Account Binding, EAB for short, is the mechanism that ties an ACME account to your paid subscription. After the order we email you two values, a key ID called kid and an HMAC key. Your client presents them once, when it registers its ACME account, and from then on every certificate request runs under your subscription with its authorization. Without EAB anyone who knew the server address could issue certificates at your expense, which is exactly what this prevents. Treat the pair like a password: store it securely in your configuration, keep it out of public repositories, and if you suspect it has leaked, contact our support.
Technically nothing changes in your tooling: it is the same ACME v2 protocol, so the clients, commands and cron jobs you would use with Let's Encrypt work unchanged. You only point them at the Sectigo directory URL and add the EAB pair. What the paid subscription adds is a longer certificate lifetime of 1 year, so renewal events are rarer and an automation fault leaves you a much wider safety margin, room for up to 255 SANs on a single certificate, OV-chain options for organizations that want validated company details in the chain, and a support team you can actually write to when something in the pipeline misbehaves.
One subscription is scoped to one registered domain. Everything under that domain can live on the same certificate: hostnames like www, mail or api are added as individual SANs, and a wildcard SAN covers a whole level of subdomains at once. A separate domain, even one belonging to the same company, needs its own subscription, ordered the same way and delivered with its own directory URL and EAB credentials. In practice your servers can run several ACME configurations side by side, one per domain, and each renews independently. If you manage a larger portfolio of domains, write to our support and we will help plan the structure.
The base subscription costs 17.63 EUR a year per domain and includes 1 SAN. That single flat fee covers the protocol activity itself: your client can issue, reissue and renew certificates as often as its schedule requires, and none of those operations costs anything extra. If the setup grows, you extend the same certificate with additional hostname SANs or wildcard SANs, up to 255 in total; each add-on has its own annual price shown in the table on this page. So the yearly total is simply the base fee plus the add-ons you actually use, with nothing metered and no surprises at renewal time.
No, manual handling is exactly what this subscription removes. The one-time work is the setup: install an ACME client such as certbot, acme.sh or Caddy, give it the Sectigo directory URL and your EAB credentials, and tell it which hostnames belong on the certificate. From then on the client requests the certificate, places the files where your web server expects them and reloads the service, then repeats the whole cycle on schedule without human action. What we still recommend is an occasional glance at the client logs after configuration changes, since a typo in a new hostname is easier to catch early than at renewal.
A failed renewal attempt is not an outage. Your existing certificate stays valid until its expiry date, and because subscription certificates are issued for 1 year and clients start renewing well before that date, there is usually a long window in which the site keeps working normally while you investigate. ACME clients also retry automatically on their next scheduled run, so a temporary problem often resolves itself. Typical persistent causes are an expired DNS API token, a changed record or a firewall blocking the client; the client logs show which step failed. If you cannot find the cause, our support team helps you debug the setup.
Deploy in minutes or talk to an engineer about what fits your project.