ACME Automation

Available in Classic and VPC

In ACME, you can view the Directory URL required for ACME client integration and manage the External Account Binding (EAB) key used for authentication. This method is supported only when issuing Enterprise Certificate certificates (Advanced DV/OV).

For details, see Automated certificate management with ACME.

ACME interface

The ACME interface includes the following components:

certificatemanager-uselist-acme_ko

Component	Description
① Menu name	Current menu name and total number of registered EABs.
② Basic features	Key tasks available in ACME. [Issue EAB key]: Generate a new EAB key. [Learn more]: Go to the Certificate Manager overview page. [Refresh]: Update the EAB list to the latest version.
③ Revoke	Revoke the selected EAB so that it can no longer be used.
④ EAB list	Displays the list of registered EABs. For security reasons, the EAB Key and HMAC Key can only be viewed at the time of initial issuance and are not displayed in the console thereafter.

Issue an EAB key

To issue an EAB key in the ACME menu:

In the NAVER Cloud Platform console, navigate to Menu > Services > Security > Certificate Manager > ACME.
Click [Issue EAB key].
Enter and verify the following items in the settings window.
- Alias: Enter a name to identify the EAB key.
- Product: Select Advanced DV or Advanced OV.
  - Accounts registered under this EAB can only issue certificates for the selected product type.
- Organization: If you select an OV product, select the organization information to include in the certificate O (Organization) field. (Only information about active organizations is displayed.)
  - By pinning organization information, security is enhanced as OV certificates are issued only to the organization specified for that domain.
- Validity period: Set the maximum validity period for certificates issued through the ACME client. (Select 198 days, 90 days, or 30 days.)
  - While the order subscription is valid, you can reissue certificates an unlimited number of times at no additional cost.

Configure the validation method

When issuing certificates based on ACME, certificates can only be issued using the configured validation method.

DNS-01 method: Register a new validation value in DNS each time a certificate is issued. It uses the ACME standard protocol as-is and requires the client to configure automation scripts.
Prevalidation method: Reuse DNS TXT validation completed in advance in the Domains menu. You can issue certificates immediately without any additional steps while the validation period is valid, which simplifies management.

Note

You can view the EAB Key and HMAC Key only when they are first created. You cannot view them again if they are lost, so record them separately and keep them in a secure place.

Revoke an EAB

Keep the following in mind when revoking an EAB:

Certificate issuance and management using the ACME client based on the revoked EAB information will be discontinued immediately.
This will not affect certificates that have already been issued, but automatic renewal and other functions will no longer be available.