Trustico® CaaS Domain Validation (DV) is a single-domain SSL Certificate delivered through Trustico® Certificate as a Service (CaaS), for teams that want to obtain and manage SSL Certificates programmatically rather than by hand. It is issued and reissued automatically through the Automatic Certificate Management Environment (ACME) protocol.
It suits teams provisioning SSL Certificates through continuous integration and deployment (CI/CD) pipelines, managing infrastructure as code, or building SSL Certificate issuance into automated deployment workflows, where manual steps are not practical.
When you order, you provide your domain without the www prefix, and Trustico® adds the www version as an additional name at no charge. Ordering yourdomain.com therefore covers both yourdomain.com and www.yourdomain.com, so your ACME client can request either name.
For names that would not normally use a www prefix, such as mail.yourdomain.com or ftp.yourdomain.com, the www version is not added automatically, though you can ask for it to be added. If you order www.yourdomain.com directly, only that name is issued.
The sections below explain how Trustico® CaaS Domain Validation is issued, how the automation works, and how to put it in place.
The Case for Certificate as a Service (CaaS)
Traditional SSL Certificate management involves manual steps at every stage : generating a Certificate Signing Request (CSR), completing validation, downloading files, and installing them on each server. Certificate as a Service (CaaS) replaces those steps with automation that handles ordering, validation, issuance, and reissue for you.
When you order Trustico® CaaS Domain Validation, you are buying an SSL Certificate license for a set period. Throughout that period your ACME client reissues the SSL Certificate as it approaches expiry, extending the expiry date of the installed SSL Certificate against the validity remaining on your license. You order once and the domain stays protected for the term.
When the license period nears its end, you can extend it without any reinstallation or reconfiguration. The extended validity is recognized automatically, and there is no need to generate new External Account Binding (EAB) credentials or change your server. Learn About License Extensions 🔗
The Automated SSL Certificate Lifecycle
Trustico® CaaS Domain Validation uses the Automatic Certificate Management Environment (ACME) protocol to handle the SSL Certificate lifecycle. Your server runs an ACME client that talks to the Certificate Authority (CA), and it manages domain verification, issuance, and reissue without manual steps.
You install an ACME client and authenticate it once using External Account Binding (EAB) credentials from your Trustico® account. The client then proves control of the domain through an HTTP-01 challenge or a Domain Name System (DNS) challenge, and once the Certificate Authority (CA) confirms control, the SSL Certificate is issued and installed.
Before each expiry, the client repeats validation and fetches a reissued SSL Certificate, so protection continues without downtime. Explore ACME Protocol Details 🔗
Supported ACME Clients and Server Environments
Trustico® CaaS Domain Validation works with the major ACME clients, so you can use the tool that fits your setup. Certbot is common on Linux systems running Apache or Nginx, while win-acme and Certify The Web give native support on Windows and Microsoft Internet Information Services (IIS).
For containers, cert-manager integrates with Kubernetes, and acme.sh is a lightweight shell option for scripted deployments.
Further clients such as lego, dehydrated, and Posh-ACME cover Go, shell, and PowerShell environments. These clients deploy across Apache, Nginx, Microsoft Internet Information Services (IIS), cPanel, Plesk, Docker, Kubernetes, Caddy, and the major cloud platforms.
Whichever environment you run, the workflow is the same : authenticate with External Account Binding (EAB) credentials, complete the domain challenge, and receive your SSL Certificate. Find Out More About Supported ACME Clients 🔗
Tip : If your website runs on cPanel, the Trustico® Certificate as a Service (CaaS) cPanel Plugin brings automated SSL Certificate management directly into your hosting control panel, without the command line. It retrieves, installs, and reissues your SSL Certificates from within cPanel itself. Explore the Trustico® cPanel Plugin 🔗
On cPanel hosting, the plugin fills the role of the ACME client, so the same automation runs without any command line work.
External Account Binding Credentials
External Account Binding (EAB) is the mechanism that links your ACME client to the Certificate Authority (CA). When you set up the client, you provide a Key Identifier and an HMAC Key generated in your Trustico® account, and these confirm that the client is authorized to request SSL Certificates under your account.
Each set of External Account Binding (EAB) credentials can be managed separately, so you can hold different bindings for different servers, environments, or pipelines. That keeps clear track of which systems request SSL Certificates. View Our EAB Credential Setup Guide 🔗
Domain Validation
This SSL Certificate is issued through automated Domain Validation (DV) that usually completes within minutes. The ACME client answers a challenge from the Certificate Authority (CA) on your behalf. With an HTTP-01 challenge, the client places a verification file on your web server for the Certificate Authority (CA) to retrieve.
With a Domain Name System (DNS) challenge, the client creates a temporary Domain Name System (DNS) TXT record instead. That method suits servers behind a firewall, on internal networks, or where port 80 is not publicly reachable. Both methods are automated, with no manual file uploads or e-mail approvals. Learn About Domain Validation 🔗
Encryption and Protocols
Trustico® CaaS Domain Validation uses a 2048-bit RSA key with 256-bit symmetric encryption to secure data in transit, over the Transport Layer Security (TLS) 1.2 and 1.3 protocols with SHA-256 hashing. This gives broad compatibility across modern browsers and devices.
Certificate Transparency logging adds accountability, and Elliptic Curve Cryptography (ECC) keys are also supported for environments that benefit from smaller keys and faster handshakes. Compare Encryption Standards 🔗
Preparing for Shorter Validity Periods
Industry rules are reducing the maximum validity of an individual SSL Certificate in stages, to 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. SSL Certificates will therefore need replacing far more often than the annual cycle most teams are used to.
Without automation, each cycle means generating a Certificate Signing Request (CSR), validating the domain, downloading the SSL Certificate, and installing it. At a 47 day cycle that is a heavy, repeating task. Certificate as a Service (CaaS) handles each reissue automatically, so the change in validity makes little difference to you. Explore Traditional and CaaS Compared 🔗
USD $500,000 Warranty
Every Trustico® CaaS Domain Validation SSL Certificate carries a USD $500,000 Relying Party Warranty, which provides financial cover in the unlikely event that the Certificate Authority (CA) issues the SSL Certificate in error. Reissues are unlimited across the license through the automation. Review Warranty Details 🔗
Trustico® Site Seal
Your order includes a complimentary Trustico® site seal that you can display on the secured site to reassure visitors. It works well on payment, sign-up, and contact pages. Explore the Trustico® Site Seal 🔗
Browser Compatibility
Trustico® CaaS Domain Validation is trusted by around 99.9% of web browsers, including Chrome, Firefox, Safari, and Edge. Mobile devices on iOS and Android trust the domain without any additional configuration. Understand Browser Compatibility 🔗
Unlimited Server Licenses
You can install Trustico® CaaS Domain Validation on as many servers as you need at no extra cost, which suits cloud-native setups that use load balancing, redundancy, containers, and distributed systems. The same SSL Certificate and key are deployed to each server that serves the domain.
Programmatic Installation
The ACME client installs the SSL Certificate for you by generating the Certificate Signing Request (CSR), completing validation, and deploying it. Documentation covers integration for Apache, Nginx, Microsoft Internet Information Services (IIS), and the major cloud platforms. Access Installation Guides 🔗
Guides and Resources
Trustico® provides guides covering ACME client setup, External Account Binding (EAB) configuration, domain validation, and deployment. For command syntax and reissue scheduling specific to your client, refer also to that client's own documentation. Browse Technical Resources 🔗
Who Should Use Trustico® CaaS Domain Validation
It fits teams running automated deployment pipelines that need single-domain SSL Certificates provisioned as part of continuous integration and deployment (CI/CD), and serverless applications that deploy custom domains through platforms such as AWS Lambda, Azure Functions, or Google Cloud Functions.
It also suits managed service providers issuing SSL Certificates for client domains, e-commerce platforms that secure merchant custom domains during onboarding, and hosting platforms that offer SSL as a built-in feature. Configuration management tools such as Ansible, Terraform, and Puppet can apply it consistently across development, staging, and production.
Other Options
If you do not need programmatic automation and would rather manage a single-domain SSL Certificate by hand, the standard Domain Validation option covers the same domain. Compare Domain Validation Single Site 🔗
