Skip to main content

EAB-bound CAs

External Account Binding ties an ACME account to an existing customer record at the CA. This page tells you where the kid + HMAC come from for each EAB-required provider.

What EAB is​

An ACME account is normally created anonymously: anyone can register. EAB requires the registration to include an HMAC over the new-account request, signed with a per-customer key the CA gave you out-of-band. This proves you are an authorised customer before the CA accepts the registration.

You only do this once per account. After registration, normal ACME issuance proceeds without any further EAB interaction.

What CertAutoPilot needs​

Two values:

  • kid — the key identifier issued by the CA. A short opaque string.
  • HMAC key — base64url-encoded, used to sign the EAB binding.

Google Trust Services​

In the Google Cloud Console: Public Certificate Authority → External Account. Click Generate, copy the Key ID (this is the kid) and the HMAC. The pair is single-use — re-generate if you need to register another account.

ZeroSSL​

ZeroSSL dashboard → Developer → EAB Credentials. Generate Credential. Both the kid (called EAB KID) and the HMAC key appear once; copy and save before closing.

SSL.com​

The customer dashboard → API Credentials → ACME EAB. Per ACME directory (separate KIDs for DV vs OV vs EV product lines).

Sectigo​

Issued by your Sectigo account manager via the Customer Portal. Ask for an ACME account binding for the certificate profile you intend to use; expect a same-day turnaround.

GlobalSign Atlas​

Atlas portal → API & Configuration → ACME Account. Generate an EAB pair scoped to your Atlas account.

DigiCert CertCentral​

CertCentral → Account → ACME Directory URLs. Each product profile has its own ACME URL and EAB credential; copy both.

Actalis​

Issued via the Actalis customer-portal API. Talk to your account contact; the credentials are scoped to a contract.

Pasting into CertAutoPilot​

  1. Settings → ACME Accounts → New.
  2. Pick the CA. The form shows the EAB section automatically.
  3. Paste the kid and HMAC key.
  4. Save. The server runs the EAB-bound new-account flow and stores the resulting account URL.

Rotating the EAB key​

Once the ACME account is registered, the EAB key is no longer used. To rotate account keys, use the standard ACME key rollover (UI or POST /acme-accounts/{id}/rotate-key). Re-issuing the EAB pair only matters if you are creating a new account.

See also​