Public CA via ACME + External Account Binding (EAB)

Commercial and public CAs — Google Trust Services, Sectigo, DigiCert,
ZeroSSL and others — issue over ACME, but unlike Let's Encrypt they require
External Account Binding (EAB) to tie your ACME account to your existing CA
account. CertTracker supports these as an ordinary ACME issuer plus an EAB
key ID and an HMAC credential that lives on the agent. Once set up, they
behave exactly like any other issuer — point a managed cert at them and issue.

Supported CAs

CertTracker issues from any ACME CA. The public CAs it recognises by name
today are:

• Let's Encrypt — ACME, no EAB (built in: Production and Staging).
• Google Trust Services — ACME + EAB.
• Sectigo — ACME + EAB (via Sectigo Certificate Manager).
• DigiCert — ACME + EAB.
• ZeroSSL — ACME + EAB.
• GoDaddy — ACME + EAB.
• GlobalSign — ACME + EAB (Atlas).
• Buypass — ACME.
• Actalis — ACME + EAB.
• SSL.com — ACME + EAB.
• Entrust — ACME + EAB.
• Amazon — ACME (AWS / Amazon Trust Services).

Any other CA that speaks ACME works the same way — add it as an ACME issuer with
its directory URL (and an EAB key where the CA requires one). Commercial CAs
almost always require EAB; Let's Encrypt and Buypass do not. Internal Microsoft
AD CS is supported separately over SCEP and CES/CEP (see the internal-CA
guides).

What EAB is

EAB (RFC 8555 §7.3.4) links a brand-new ACME account to an account you already
hold at the CA. The CA gives you two things out of band: a Key ID (kid) and
an HMAC key. The first time the agent registers an ACME account, it presents
a short signature made with that HMAC key, and the CA binds the new account to
your organization. After that, the account is reused like any ACME account — the
EAB key is only used once, at registration.

The HMAC is a secret, so it never enters CertTracker. The issuer stores only a
credential reference; the actual HMAC is loaded onto the agent.

Step 1 — Get EAB credentials from your CA

• Google Trust Services — in a Google Cloud project with the Public
  Certificate Authority API enabled, run:
  gcloud publicca external-account-keys create
  It returns a keyId and a b64MacKey. Two things to know: the key is
  single-use (it registers one account, then it's spent) and expires 7 days
  after creation, and GTS requires an account contact email. The GTS DV
  directory URL is https://dv.acme-v02.api.pki.goog/directory.

• Sectigo — in Sectigo Certificate Manager (SCM), enable ACME for your
  organization/domain and create an ACME account. SCM gives you the EAB Key
  ID, the HMAC key, and the directory URL for your account. Sectigo
  domains are often pre-validated at the organization level (delegated DCV),
  which lets you skip per-order validation (see below).

• DigiCert and others — generate EAB credentials in the CA's portal or API
  and use the directory URL they provide.

Keep the keyId and HMAC handy — you'll paste them in the next two steps.

Step 2 — Add the issuer

CAs tab → + Add issuer:

• Name — anything meaningful (e.g. Google Trust Services).
• Type — ACME.
• ACME directory URL — from your CA (GTS DV:
  https://dv.acme-v02.api.pki.goog/directory).
• ACME account email — required by some CAs (GTS rejects contactless
  accounts) and recommended everywhere so the CA can send expiry notices.
• EAB key ID — the kid from your CA, exactly as given. Don't include a
  trailing bracket, space, or quote — a stray character produces an "Unknown
  external account binding key" error.
• Credential ref — an opaque name you'll store the HMAC against on the agent
  (e.g. gts-eab).
• Domains pre-validated at the CA — tick this only if the CA already
  authorizes your domains (e.g. Sectigo SCM org-level DCV). Leave it unticked for
  normal per-order validation (DNS-01 / HTTP-01), which is the default for
  public issuance such as GTS.

Step 3 — Store the HMAC on the agent

The EAB HMAC is a secret, so it goes on the agent, not in CertTracker. The fastest
way: on the issuer row, click the credential ref link — it opens that agent's
Credentials card with the ref pre-filled and the form open. Paste the HMAC
(the b64MacKey) as the secret value and save; CertTracker forwards it to the
agent and keeps no copy. (You can also reach it via Automation → the agent →
Credentials.)

On the agent host directly, the equivalent is:

sudo clm-agent-cred put gts-eab --field tsig_secret=<b64MacKey>

Step 4 — Authorize the CA in DNS (CAA)

If your domains publish CAA records, add an issue entry for the CA or
issuance fails with a CAA error:

• Google Trust Services — CAA 0 issue "pki.goog"
• Sectigo — CAA 0 issue "sectigo.com"

On a BIND zone, bump the SOA serial and reload (rndc reload) so the record
publishes. See Renewal DNS Health & DNS-01 Preflight for checking CAA before
you issue.

Step 5 — Test & Verify

ACME issuers have Test and Verify buttons (pick which agent runs them):

• Test — read-only. It fetches the ACME directory and sanity-checks your EAB
  config and account email. It never registers an account, so it never spends
  a single-use EAB key — run it as often as you like.
• Verify — everything Test does plus registers (or confirms) the ACME
  account, EAB-bound. It is reuse-aware: a single-use EAB key is spent only on
  the first Verify of a new issuer; after that the saved account is reused.

The issuer shows Untested → Tested → Verified, and the results link opens
the full checklist with a specific hint on any step that fails.

Per-call validation vs pre-validated domains

• Per-call (default) — for each order the agent proves control of the domain
  with DNS-01 or HTTP-01. Set up a validation key on the Zone DNS tab
  for DNS-01. This is how public issuance (GTS, Let's Encrypt) normally works.
• Pre-validated — some CAs authorize your domains at the account level
  (e.g. Sectigo SCM delegated DCV). Tick Domains pre-validated at the CA and
  the agent skips per-order challenges, expecting the authorizations already
  valid. If a domain isn't actually pre-authorized, issuance fails fast rather
  than silently hanging on a challenge.

Issue a certificate

Managed Certificates → create one, pick your EAB issuer, set the common name
and agent, and issue. For per-order validation, make sure a DNS-01 key is in place
first (Zone DNS). The rest — renewal and deployment — is identical to any
other issuer.

About single-use EAB keys

This trips people up, so it's worth stating plainly: a GTS or Sectigo EAB key
registers one ACME account and is then spent (GTS also expires it after 7
days). That is not per-certificate. CertTracker registers the account once
and reuses it for every issuance and renewal — you never need a fresh EAB key
per cert. You only need a new EAB key if the issuer's account is removed and has
to re-register.

If you ever see "Unknown external account binding key", the key was wrong, had a
stray character, was already used, or expired. Generate a fresh one, update both
the credential (the new HMAC) and the issuer's EAB key ID (the new
keyId), and run Verify again.

Troubleshooting

• externalAccountRequired — the CA needs EAB but none was presented. Check
  the EAB key ID is set and the HMAC credential is stored on the agent
  under the issuer's ref (the Test check flags a missing HMAC).
• unauthorized :: Unknown external account binding key — the key ID or HMAC
  is wrong, the key has a stray character, or it was already used/expired.
  Generate a fresh key and update both fields.
• Accounts must have at least one contact — add an ACME account email
  on the issuer (GTS requires one).
• CAA error — authorize the CA in your CAA records (Step 4).

Related

• Issuers — Choosing Where Certificates Come From
• Zone DNS — DNS-01 Validation Keys
• Renewal DNS Health & DNS-01 Preflight
• CLM Troubleshooting