Cisco ASA and appliances without EAB support

Some appliances let you point at a custom ACME server URL but have no fields for an EAB Key ID and HMAC key. FairSSL gives you a single-use enrollment URL that carries the binding inside the URL, so these devices can register with just the one field they already have. The credential is one-time and retires itself the moment the account is created.

When to use the enrollment URL

Use this No EAB fields

Appliance has only an ACME URL field

Cisco ASA, FortiOS before 7.6.3, and other VPN/firewall firmware that accept a custom ACME server or directory URL but cannot enter an EAB Key ID and HMAC key. The enrollment URL is for exactly these.

Use normal EAB Has EAB fields

Client supports EAB

If your client has EAB Key ID / HMAC fields (FortiOS 7.6.3+, certbot, Lego, simple-acme, cert-manager, and so on) use a standard EAB key instead — see the ACME client guides.

Set it up

Step 1: Create a single-use enrollment URL

In your FairSSL control panel, open the ACME profile for this device, go to the EAB keys tab and create a key with usage single-use. FairSSL shows an enrollment URL next to the key. Copy it — it looks like this:

https://fairssl.dk/acme/t/<your-enrollment-token>

The enrollment URL is only shown for single-use keys. Reusable keys do not get one. Generate one URL per appliance.

Step 2: Configure FairSSL AutoDNS

In the FairSSL control panel go to AutoDNS and create a CNAME for _dnsauth.<your-domain> pointing at the FairSSL DNS server. AutoDNS answers the challenge over DNS-01, so the appliance never needs port 80 open. See the full AutoDNS guide.

Step 3: Paste the URL into the appliance

In the appliance\'s ACME / automatic-certificate settings, set the ACME server URL (sometimes labelled Directory URL or CA URL) to the enrollment URL from step 1. Leave any EAB Key ID and HMAC fields blank — the binding is already inside the URL.

# Cisco ASA — illustrative; exact keywords vary by firmware
crypto ca trustpoint FAIRSSL-ACME
  enrollment protocol acme url https://fairssl.dk/acme/t/<your-enrollment-token>
  fqdn vpn.example.com
  subject-name CN=vpn.example.com

The exact field name and CLI depend on your appliance and firmware version. The one rule that always applies: the ACME URL is the enrollment URL, and there are no separate EAB fields to fill in.

Step 4: Enroll

Trigger enrollment from the appliance (for example crypto ca authenticate then crypto ca enroll on a Cisco ASA, or the equivalent button in the GUI). The appliance fetches the directory from the enrollment URL, registers an account, validates the domain via AutoDNS and downloads the certificate. This usually finishes in well under a minute.

Step 5: Verify

Confirm the appliance reports the certificate as installed and valid, then check the public FQDN with FairSSL\'s SSL scanner to make sure the right certificate is being served.

How the single-use credential behaves

One account, then retired. The URL can create exactly one ACME account and is consumed the moment that account is created. A failed attempt (bad nonce, clock skew) does not consume it, so the appliance can retry.
Renewals keep working. After registration the appliance authenticates with its own account key. The enrollment URL stays a valid entry point, so leave it configured — renewals and re-fetches keep working forever.
New key needs a new URL. If the appliance is reset and generates a brand-new account key, the spent URL cannot create a second account. Generate a fresh single-use key and enrollment URL.

Frequently asked questions

Find answers to the most common questions about SSL certificates and FairSSL.

Why can't my Cisco ASA or appliance use a normal EAB key?

Some appliances (Cisco ASA, older FortiOS before 7.6.3, and various VPN/firewall firmware) let you set a custom ACME server URL but have no fields for an EAB Key ID and HMAC key. FairSSL requires External Account Binding, so those devices normally cannot register. The enrollment URL solves this: the binding credential is carried inside the URL itself, so the appliance only needs the one field it already has.

Is the enrollment URL safe to put in a device config?

The enrollment URL is a single-use credential. It can create exactly one ACME account and is retired automatically the moment that account is created. After that the appliance authenticates with its own account key, exactly like any other ACME client, and the URL can no longer create a new account. Generate it, paste it into the appliance, and enroll.

Do I need to keep the enrollment URL after the first certificate?

No. Keep the appliance pointed at the URL — it stays a valid entry point forever, so renewals keep working — but the credential part is spent after the first registration. If you ever factory-reset the appliance and it generates a brand-new account key, create a fresh single-use key and a new enrollment URL.

Does the appliance need port 80 open to the internet?

No. Use FairSSL AutoDNS so the domain is validated over DNS-01 on our side. The appliance never has to expose an HTTP challenge endpoint.

Can I use a reusable EAB key in the URL?

No. The URL form is only offered for single-use keys, and the server rejects it for reusable keys. A reusable key would be a long-lived secret sitting in the URL; single-use keeps the exposure to a single registration. If you need to onboard several appliances, generate one single-use enrollment URL per device.

My ACME client does support EAB. Should I still use this?

No. If your client has EAB Key ID and HMAC fields, use the normal flow with a standard EAB key — see the appliance and ACME client guides. The enrollment URL exists only for clients that cannot enter EAB credentials at all.

Ready to automate certificates on your appliance?

Create a free account and issue your first certificate in under 10 minutes.

Create free account Compare certificates