Background

The Automated Certificate Management Environment (ACME) is a protocol that enables the automated issuance and renewal of SSL/TLS certificates. At UC Berkeley, ACME is primarily used to obtain Domain Validated (DV) certificates via Let's Encrypt or Organization Validated (OV) certificates via Sectigo. While the certificate types are functionally similar, your choice of Certificate Authority (CA) may be influenced by your server's network configuration.

* Note: Industry standards for certificate lifespans are continuesly shortening. Refer to Sectigo and Let's Encrypt updates.

Recommendations

Internet-Available Sites

If your web server is open to the Internet, the simplest option is a free CA like Let's Encrypt or ZeroSSL. These provide trusted certificates as long as your server can be reached via HTTP for validation.

Firewalled or Internal Sites

If your servers are behind a firewall or not open to the Internet, use the Sectigo ACME service. This allows for consistent configuration across both open and restricted environments but requires a more complex initial setup.

Protecting ACME Secrets

Unlike Let's Encrypt, Sectigo's ACME secrets can cover multiple domains. These secrets must be handled with extreme care. If compromised, they can be used to request an unlimited number of certificates for any delegated domain assigned to that account.

Access to ACME secrets must be limited to required personnel. We recommend storing these in a secure vault or password manager such as LastPass Business (KB0013779).

Process for Sectigo ACME

Prerequisites

• You must be a Departmental Certificate Administrator (DCA).
• The FQDNs requiring certificates must be delegated to your department.

Step-by-Step Configuration

1. Log into the Cert-Manager portal.
2. Navigate to Domains and expand berkeley.edu to see your delegated domains.
3. Ensure all required FQDNs (e.g., app1.dept.berkeley.edu) are explicitly listed. Click the Green Plus (+) button to add missing FQDNs.

   

4. Navigate to Enrollment > ACME in the left sidebar.
5. Select https://acme.sectigo.com/v2/OV and click Accounts.
6. Click the Green Plus (+) to create a new ACME account (e.g., training_app1).
7. Click the plus sign next to Domains to add your FQDNs to this specific account.
   Warning: Never assign wildcard domains to an ACME account.

   

8. The next screen displays your External Account Binding (EAB) details. Save these securely in a password manager. You will need the URL, Key ID, and HMAC Key.

   

Connecting with Certbot

Sectigo recommends Certbot as the supported ACME client. Follow the Official Certbot Instructions for your specific OS and web server.

Example Commands

Linux (Standalone):

sudo certbot certonly --standalone --non-interactive --agree-tos --email {user@berkeley.edu} --server https://acme.sectigo.com/v2/OV --eab-kid {Key_ID} --eab-hmac-key {HMAC_Key} --domain {your.domain.edu} --cert-name {friendly_name}

Windows (Admin CMD):

certbot certonly --standalone --non-interactive --agree-tos --email {user@berkeley.edu} --server https://acme.sectigo.com/v2/OV --eab-kid {Key_ID} --eab-hmac-key {HMAC_Key} --domain {your.domain.edu} --cert-name {friendly_name}