acmewiz

1. Account and domains

Paste the External Account Binding (EAB) credentials you were issued, then say which names the certificate is for.

External Account Binding required

EAB key identifier (KID)

EAB HMAC key

Contact email

Used for the ACME account and expiry warnings.

Domains

One per line, or separated by spaces or commas. The first becomes the common name. Wildcards (*.example.com) need DNS‑01 validation.

Advanced

Certificate key type and size

ECDSA P-256 suits almost everything and is the default. Pick RSA only if something in the chain cannot handle an EC certificate.

Certificate lifetime

2. ACME client

Which client will run on the machine that needs the certificate?

3. Validation and web server

How should the CA verify that you control these names, and what should be reloaded afterwards?

Challenge type

DNS‑01Works behind firewalls, supports wildcards. Needs DNS API credentials. HTTP‑01Serves a file from your web root. No DNS credentials, no wildcards.

DNS provider

Web server to install into optional

4. Credentials and paths

DNS provider credentials

Web server

Advanced

DNS propagation wait (seconds)

Leave blank to use the client's default. Raise it for slow or split-horizon DNS.

Client state directory

Where the client keeps its account key, certificates and credentials.

1. Account and domains

2. ACME client

3. Validation and web server

4. Credentials and paths

5. Run these commands