Sectigo® CaaS Domain Validation (DV) is a single-domain SSL Certificate delivered through Trustico® Certificate as a Service (CaaS). It is issued and reissued automatically through the Automatic Certificate Management Environment (ACME) protocol, so teams can manage SSL Certificates programmatically rather than by hand.
It pairs the trust of a long-established Certificate Authority (CA) with automated delivery, which suits teams provisioning SSL Certificates through continuous integration and deployment (CI/CD) pipelines, managing infrastructure as code, or building issuance into automated workflows.
When you order, you provide your domain without the www prefix, and Trustico® adds the www version as an additional name at no charge. Ordering yourdomain.com therefore covers both yourdomain.com and www.yourdomain.com, so your ACME client can request either name.
For names that would not normally use a www prefix, such as mail.yourdomain.com or ftp.yourdomain.com, the www version is not added automatically, though you can ask for it to be added. If you order www.yourdomain.com directly, only that name is issued.
The sections below explain how Sectigo® CaaS Domain Validation is issued, how the automation works, and how to put it in place.
Sectigo® as a Trusted Certificate Authority
Sectigo® is a long-established, widely trusted commercial Certificate Authority (CA), with root Certificates present in virtually every browser, operating system, and device. Because of that, an SSL Certificate issued under the Sectigo® roots is recognized straight away, with no extra configuration or trust store updates.
Choosing Sectigo® CaaS Domain Validation gives you that established trust together with automated delivery through the Trustico® platform. Learn About the Sectigo® Certificate Authority 🔗
The Case for Certificate as a Service (CaaS)
Traditional SSL Certificate management involves manual steps at every stage : generating a Certificate Signing Request (CSR), completing validation, downloading files, and installing them on each server. Certificate as a Service (CaaS) replaces those steps with automation that handles ordering, validation, issuance, and reissue for you.
When you order Sectigo® CaaS Domain Validation, you are buying an SSL Certificate license for a set period. Throughout that period your ACME client reissues the SSL Certificate as it approaches expiry, extending the expiry date of the installed SSL Certificate against the validity remaining on your license. You order once and the domain stays protected for the term.
When the license period nears its end, you can extend it without any reinstallation or reconfiguration. The extended validity is recognized automatically, and there is no need to update your External Account Binding (EAB) credentials or change your server. Learn About License Extensions 🔗
The Automated SSL Certificate Lifecycle
Sectigo® CaaS Domain Validation uses the Automatic Certificate Management Environment (ACME) protocol, defined in RFC 8555, to run the SSL Certificate lifecycle. An ACME client on your server talks to the Certificate Authority (CA) and manages domain verification, issuance, and reissue without manual steps.
You authenticate the client once using External Account Binding (EAB) credentials from your Trustico® account. It then proves control of the domain through an HTTP-01 challenge or a Domain Name System (DNS) challenge, and once the Certificate Authority (CA) confirms control, the SSL Certificate is issued and installed.
Before each expiry, the client repeats validation and fetches a reissued SSL Certificate, so protection continues without downtime. Explore ACME Protocol Details 🔗
Supported ACME Clients and Platforms
Sectigo® CaaS Domain Validation works with the major ACME clients. Certbot is common on Linux systems running Apache or Nginx, while win-acme and Certify The Web give native support on Windows and Microsoft Internet Information Services (IIS).
For containers, cert-manager integrates with Kubernetes, and acme.sh is a lightweight shell option for scripted deployments. Further clients such as lego, dehydrated, and Posh-ACME cover Go, shell, and PowerShell environments.
Whichever client you choose, it authenticates with the Certificate Authority (CA) through the same External Account Binding (EAB) process from your Trustico® account. Find Out More About Supported ACME Clients 🔗
Tip : If your website runs on cPanel, the Trustico® Certificate as a Service (CaaS) cPanel Plugin brings automated SSL Certificate management directly into your hosting control panel, without the command line. It retrieves, installs, and reissues your SSL Certificates from within cPanel itself. Explore the Trustico® cPanel Plugin 🔗
On cPanel hosting, the plugin fills the role of the ACME client, so the same automation runs without any command line work.
External Account Binding Credentials
External Account Binding (EAB) links your ACME client to the Certificate Authority (CA). You generate a Key Identifier and an HMAC Key in your Trustico® account and provide them during the client's first registration, which confirms that the client is authorized to request SSL Certificates under your account.
The credentials are provided once per client installation. After that, the client requests new SSL Certificates and handles reissue without repeating the step, and you can generate separate credentials for different servers or environments. View Our EAB Credential Setup Guide 🔗
Domain Validation
This SSL Certificate is issued through automated Domain Validation (DV) that usually completes within minutes. The ACME client answers a challenge from the Certificate Authority (CA) on your behalf. With an HTTP-01 challenge, the client places a verification file on your web server for the Certificate Authority (CA) to retrieve.
With a Domain Name System (DNS) challenge, the client creates a temporary Domain Name System (DNS) TXT record instead. That method suits servers behind a firewall, on internal networks, or where port 80 is not publicly reachable. Both methods are automated, with no manual file uploads or e-mail approvals. Learn About Domain Validation 🔗
Encryption and Protocols
Sectigo® CaaS Domain Validation uses a 2048-bit RSA key with 256-bit symmetric encryption to secure data in transit, over the Transport Layer Security (TLS) 1.2 and 1.3 protocols with SHA-256 hashing. This gives broad compatibility across modern browsers and devices.
Certificate Transparency logging adds accountability, and Elliptic Curve Cryptography (ECC) keys are also supported for environments that benefit from smaller keys and faster handshakes. Compare Encryption Standards 🔗
Preparing for Shorter Validity Periods
Industry rules are reducing the maximum validity of an individual SSL Certificate in stages, to 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. These reductions apply to every publicly trusted Certificate Authority (CA), Sectigo® included.
Without automation, each cycle means generating a Certificate Signing Request (CSR), validating the domain, downloading the SSL Certificate, and installing it. At a 47 day cycle that is a heavy, repeating task. Certificate as a Service (CaaS) handles each reissue automatically, so the change in validity makes little difference to you. Explore Traditional and CaaS Compared 🔗
USD $500,000 Warranty
Every Sectigo® CaaS Domain Validation SSL Certificate carries a USD $500,000 Relying Party Warranty, which provides financial cover in the unlikely event that the Certificate Authority (CA) issues the SSL Certificate in error. Reissues are unlimited across the license through the automation. Review Warranty Details 🔗
Sectigo® Site Seal
Your order includes a Sectigo® site seal that you can display on the secured site to reassure visitors. The Sectigo® name on the seal is one that visitors and businesses already recognize. Implement Trust Seals 🔗
Browser Compatibility
Because the Sectigo® roots are in virtually every trust store, Sectigo® CaaS Domain Validation is trusted by around 99.9% of web browsers, including Chrome, Firefox, Safari, and Edge. Mobile devices on iOS and Android trust the domain without any additional configuration. Understand Browser Compatibility 🔗
Unlimited Server Licenses
You can install Sectigo® CaaS Domain Validation on as many servers as you need at no extra cost, which suits cloud-native setups that use load balancing, redundancy, containers, and distributed systems. The same SSL Certificate and key are deployed to each server that serves the domain.
Programmatic Installation
The ACME client installs the SSL Certificate for you by generating the Certificate Signing Request (CSR), completing validation, and deploying it. Documentation covers integration for Apache, Nginx, Microsoft Internet Information Services (IIS), and the major cloud platforms. Access Installation Guides 🔗
Guides and Resources
Trustico® provides guides covering ACME client setup, External Account Binding (EAB) configuration, domain validation, and deployment. For command syntax and reissue scheduling specific to your client, refer also to that client's own documentation. Browse Technical Resources 🔗
Who Should Use Sectigo® CaaS Domain Validation
It fits teams that need SSL Certificates from a widely recognized Certificate Authority (CA) for compliance or policy reasons, provisioned as part of continuous integration and deployment (CI/CD), and serverless applications that deploy custom domains through platforms such as AWS Lambda, Azure Functions, or Google Cloud Functions.
It also suits managed service providers issuing SSL Certificates for client domains and e-commerce platforms securing merchant custom domains during onboarding. Configuration management tools such as Ansible, Terraform, and Puppet can apply it consistently across development, staging, and production.
Other Options
If you do not need programmatic automation and would rather manage a single-domain Sectigo® SSL Certificate by hand, the standard Domain Validation option covers the same domain. Compare Domain Validation Single Site 🔗
