Docs Using Account Keys

Using Account Keys

Each ACME client instance should use its own Account Key. There are three ways a client can obtain an Account key:

  1. Pre-create a single-use EAB token and provide it to the client. This allows the client to securely provision its own Account key.
  2. Pre-create the Account key and provide it to the client.
  3. Enable open registration. This can potentially be abused. See Directories -> Registration mode -> Open.

Managing Account keys and EAB tokens may both be done through the UI or the API.

Account key settings

Unless specified, values may be updated.

Name - A human-friendly name for the Account key. Use it to describe the hostname and/or client software instance that this Account key will be used by.

Contacts - Contact information for the person responsible for the related hostname or client software, formatted as a URI. Example URIs: mailto:email@example.com, tel:+1.3035551212, https://host.example.com/.

While contacts is a part of the ACME standard, it is not presently used by CertFu and is for your reference only. In a multi-person organization, it can be quite useful. If it’s not useful to you, the shortest dummy value is tel:0. Hint: when using open registration, this value is used to populate Name, so use something unique per-client.

Order validations -

  • Use challenges - This is the standard security mode for an ACME client and is generally recommended. New certs will require validation before certs are issued. Validation of domain names requires publically available DNS and possibly public HTTP access on port 80. CAA DNS records will also be validated.
  • Auto-approve - Bypass all challenges/validation checks for this client. This is required for private domains or IPs.
    Some ACME clients may get briefly confused and internally retry once to discover that the order was auto-approved. A few clients may also be unable to handle this entirely; in that case, file a bug report for the client or try another one.

Public key - When creating a new Account key, this can be used to import an existing account/key. Otherwise, when left blank, CertFu will generate a new EC keypair for you. While updates are allowed, it’s usually better to create a new Account key and delete the old one.