acmewiz

1. Account and domains

Paste the External Account Binding (EAB) credentials you were issued, then say which names the certificate is for.

External Account Binding required

EAB key identifier (KID)

EAB HMAC key

Contact email

Used for the ACME account and expiry warnings.

Domains

One per line, or separated by spaces or commas. The first becomes the common name. Wildcards (*.example.com) need DNS‑01 validation.

Advanced

Certificate key type and size

ECDSA P-256 suits almost everything and is the default. Pick RSA only if something in the chain cannot handle an EC certificate.

Certificate lifetime

2. ACME client

Which client will run on the machine that needs the certificate?

3. Validation and web server

How should the CA verify that you control these names, and what should be reloaded afterwards?

Challenge type

DNS‑01Works behind firewalls, supports wildcards. Needs DNS API credentials. HTTP‑01Serves a file from your web root. No DNS credentials, no wildcards.

DNS provider

Web server to install into optional

4. Credentials and paths

DNS provider credentials

Web server

Advanced

DNS propagation wait (seconds)

Leave blank to use the client's default. Raise it for slow or split-horizon DNS.

Client state directory

Where the client keeps its account key, certificates and credentials.

5. Run these commands

Copy all gives the commands with their commentary, to paste and read as you go. The others give a script that runs the whole thing unattended: everything that is not a command — web server config, install steps that offer a choice — is commented out in it, and it stops immediately if the client is missing. Copy as one command and Download script carry your credentials in clear text. Create a run command does not: it encrypts the script here, uploads only the ciphertext, and gives you a short-lived curl … | sh whose decryption key never reaches the server.