Issuing SSL Certificates Without Touching Your Target Server
Silvia RogersShare
A common question about Trustico® Certificate as a Service (CaaS) comes from customers whose servers cannot answer a validation challenge : machines with no path to the public internet, or environments with no Domain Name System (DNS) provider that offers an Application Programming Interface (API). The worry is that automatic issuance cannot work for them. In almost every case, it can.
The reason is simple, and it changes how you picture the whole process. Your ACME client does not have to run on the server that will use the SSL Certificate. Once you separate those two ideas, the obstacle usually disappears. Learn About ACME Clients 🔗
Common Misconception About ACME Clients
Most guides install an ACME client on every web server, so it is natural to assume the client and the SSL Certificate must live together. That is the popular default, not a requirement. The client is simply software that talks to the endpoint and proves you control the domain.
Nothing about that job ties it to the server that will present the SSL Certificate to visitors. The client can run on a laptop, a dedicated internal host, or a central automation server, and still obtain SSL Certificates for machines that never run a client of their own.
Three Parts Within Every Issuance
It helps to break an issuance into its three parts : requesting the SSL Certificate, proving control of the domain, and receiving the finished SSL Certificate. Seeing them separately makes the flexibility obvious.
None of these three parts has to happen on the machine that will eventually use the SSL Certificate. A single ACME client, placed wherever suits you, can make the request, answer the challenge, and receive the issued SSL Certificate along with its Private Key.
At that point the SSL Certificate already exists, and the server that will use it has not been involved at all. The only task left is moving the finished SSL Certificate to where it is needed. Learn About Endpoint Configuration 🔗
Your Target Server Stays Untouched
This is the point that surprises people. Through requesting, validating, and issuing, the target server is never contacted. Whether it faces the internet, sits behind a firewall, or is an appliance you cannot install software on makes no difference to the issuance itself.
So the worry that a server cannot perform validation is really a non-issue, because that server was never going to perform it. Where the ACME client sits is a choice of topology, and the choice is yours to make.
Delegating Only Your ACME Records
For the DNS method, the client proves control by publishing a short record under your domain, at a name beginning with _acme-challenge. You can let it publish that record in three ways : through your DNS provider's interface, by making the client authoritative for those records, or by delegating only that name to the client.
Note : Wildcard SSL Certificates can be validated only through the DNS method, so a delegated setup fits them naturally. The HTTP method cannot prove control of a whole class of subdomains.
Delegation is the useful part. You add a one-time alias, a CNAME, from the _acme-challenge name on your real domain to a name in a zone that the client controls. When the Certificate Authority (CA) looks for the record, it follows that alias and reads the answer the client has published. A single record sets this up :
_acme-challenge.example.com. CNAME validation.acme-host.example.net.
Because only the challenge name is delegated, the rest of your domain stays exactly as it is. Your main DNS provider is untouched, and the client needs no access to your primary zone. Learn About The Validation Procedure 🔗
The name you delegate to can even be a small DNS server running on the ACME client itself. The client then publishes and serves its own validation answers, which suits environments where handing any tool access to the primary zone is unwelcome.
Delivering Your Finished SSL Certificate
After issuance, one step remains : copying the SSL Certificate and its Private Key from the ACME client to each server that needs them. This is a straightforward transfer, handled by a script, a deployment hook, or your configuration management.
This is the only step that touches your target server, and it stays entirely under your control. You would perform this same copy whichever validation method you use, so a central client asks little of you while giving you one place to manage everything. Explore the Hosted Issuance Tool 🔗
When This Approach Helps
A central ACME client earns its place in several situations. It lets you issue SSL Certificates for appliances, load balancers, and other devices that cannot run a client of their own. It also covers internal hosts that never face the public internet.
It gives you a single, well-guarded machine that holds your credentials and manages issuance, rather than spreading that responsibility across every server. For a fleet of machines, that is often simpler to secure and to audit. Learn About External Account Binding Credentials 🔗
Validation Happens Every Issuance
One point deserves care, because it is often misunderstood. External Account Binding (EAB) authenticates your client to the Certificate Authority; it does not remove domain control validation. Each time you request an SSL Certificate, control of the domain is proven again.
A completed validation can sometimes be reused for a short period, but that window is shrinking, so in practice you should expect to validate on every issuance. Placing your client centrally does not change this. It means only that validation happens in one known place rather than on each server.
A future standard, DNS-PERSIST-01, aims to let a single standing DNS record authorize ongoing issuance, which would remove the repeated writes. It is progressing through the standards process and is not yet available for production issuance on the standard products. Learn About Persistent Authorization 🔗
Getting Started
If some servers cannot validate, the path is still open. Decide where your ACME client will run, choose how it will publish validation records, and add a step to deliver each finished SSL Certificate to the server that needs it.
The endpoints, the directory document, and the client setup are covered in depth if you want to go further, and the hosted tool is a simple way to watch the whole flow once before you build your own. Learn About ACME Endpoints Explained 🔗
