---
title: "ACME prerequisites"
slug: "certificatemanager-acme-prepare"
updated: 2026-10-08T06:58:27Z
published: 2026-10-08T06:58:27Z
canonical: "guide.ncloud-docs.com/certificatemanager-acme-prepare"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ACME prerequisites

Available in Classic and VPC

This guide explains preliminary tasks required in all environments. Be sure to complete the tasks before proceeding with the environment-specific guide.

## Before getting started

Before you start the environment-specific guide, make sure you have all of the following items ready.

- External Account Binding (EAB) credentials: Prepare the EAB Key ID and EAB HMAC Key issued in the Certificate Manager console.
  - The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it cannot be reused once account registration is complete.
- Domain validation method: Decide in advance which method to use.
- Organization pre-registration (OV certificates only): If you are using an OV certificate, organization validation must be completed in advance under **Certificate Manager** > **Organization**.
- DNS TXT record registration (prevalidation only): If you use prevalidation, register and validate the TXT record in **Certificate Manager** > **Domains**.

              Caution

              

Before requesting an OV certificate through ACME, complete validation of the organization under **Certificate Manager** > **Organization**. Issuance fails if you request a certificate for an unvalidated organization.

## Step 1: Register an organization (OV certificates only)

This step is required only when using an OV certificate. If you use DV certificates, skip this step and proceed to [Step 2: Issue EAB credentials](/docs/en/certificatemanager-acme-prepare#2%EB%8B%A8%EA%B3%84EAB%EC%9E%90%EA%B2%A9%EC%A6%9D%EB%AA%85%EB%B0%9C%EA%B8%89).

1. In the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Certificate Manager** > **Enterprise Certificate** > **ACME Automation**.
2. Click the **Organization** menu.
3. Click **[Add organization]**, then enter the contact information, organization name, address, and other details.
4. Wait until the validation is complete. Once validation is complete, the certificate will be issued immediately upon an ACME request.

              Note

              

For details about registering and validating an organization, see [Add and validate an organization](/docs/en/certificatemanager-addorganization).

## Step 2: Issue EAB credentials

EAB credentials authenticate you when registering an ACME account.

1. In the NAVER Cloud Platform console, navigate to **Menu** > **All Services** > **Security** > **Certificate Manager** > **Enterprise Certificate** > **ACME Automation**.
2. Click the **ACME** menu.
3. Click **[Issue EAB]**.
4. Verify the information on the issued credentials.

| Item | Description |
| --- | --- |
| EAB Key ID (KID) | Key identifier used when registering an ACME account |
| EAB HMAC Key | Signing key used when registering an ACME account |

              Caution

              

The EAB key is single-use. Keep this in a safe place immediately after it is issued, as it will be used up and cannot be reused when you register your account. If you lose it, you can have it reissued at the console.

## Step 3: Register a DNS TXT record (prevalidation only)

This step is required only when using prevalidation. Register the TXT record and complete the validation in **Certificate Manager** > **Domains**. Once registered, it will be reused for all future renewals.

              Note

              

If you are using the DNS-01 dynamic validation method (such as the Ncloud Global DNS hook script or the cert-manager webhook), this step is not necessary. TXT records are automatically created and deleted.

## Compare domain validation methods

There are 2 domain validation methods, depending on the EAB settings. Choose the validation method before you start the environment-specific guide.

### DNS-01 dynamic validation

| Item | Details |
| --- | --- |
| Description | Performs dynamic domain validation through the ACME protocol for each issuance and renewal. |
| Characteristics | Uses the standard ACME protocol without modification. |
| Automation conditions | Requires an Ncloud Global DNS API integration script or a Certbot DNS plugin. |
| Wildcard support | Supported |

### Prevalidation

| Item | Details |
| --- | --- |
| Description | Reuses DNS TXT validation completed in advance in the **Domains** menu of Certificate Manager. |
| Characteristics | Certificate Manager automatically processes this using its own validation data. |
| Automation conditions | Handled automatically by the client without the need to modify any DNS records. |
| Wildcard support | Supported |

              Note

              

To achieve full automation in the DNS-01 dynamic validation method, you must either use the Certbot DNS plugin provided by your DNS service or write a script that calls the DNS API to integrate with the Certbot client. This allows you to automate the process of creating and deleting DNS TXT records.

## ACME Directory URL

When following the environment-specific guides, use the URL below as the ACME directory address.

| Type | URL |
| --- | --- |
| Production environment | `https://acme.navercloudtrust.com/acme/directory` |