SSL Automation

Automate SSL/TLS certificates with ACME

FairSSL's ACME service gives IT professionals, consultants and hosting providers a fast way to automate SSL/TLS certificate management. It is secure, flexible and free from the limitations of free certificate authorities.

Built on ACME v2 (RFC 8555) with ACME Renewal Information (ARI, RFC 9773) support. Our platform automates certificate lifecycle management, including early renewal, CA switching and monitoring of both certificate and client status.

Shorter SSL lifetimes adopted

An SSL certificate can be valid for at most 199 days now, 99 days from 24 February 2027 and 46 days from 24 February 2029. Without automation, it becomes an administrative nightmare. Learn more →

The price is fixed, reissues are included

The automation fee is €33 per certificate per year and is added on top of the certificate price. One fee covers up to 25 servers, and the price stays the same no matter how often the certificate is reissued. See pricing →

Key benefits of FairSSL ACME

Free choice of CA and product

DV and OV certificates from DigiCert, Thawte, GeoTrust and RapidSSL, as single domain, SAN and wildcard. For OV the organisation is validated once, after which certificates issue automatically.

Automated domain validation

Use AutoDNS without exposing DNS API keys, ideal for internal networks and secure environments.

Centralised administration

Create profiles with product-specific settings, monitor certificate expiry and client status, switch products without changing server configuration.

Security controls

Block or allow wildcard issuance and SAN name changes per profile and per ACME client. Lock down ACME clients after setup.

High limits

No limits on the number of paid certificates, up to 1,000 duplicates and 250 SANs. Perfect for disaster recovery and scaling.

ARI: smart renewal

ACME Renewal Information (ARI, RFC 9773) checks daily whether certificates should be renewed early and lets us monitor that each server's ACME client is active and healthy.

Instant issuance with one DNS record

Publish one permanent DNS record and orders for the DigiCert brands are validated and issued immediately, both in the portal and through the ACME solution. No tokens per order. Available to customers with their own DigiCert account and for OV/EV with their own organization.

Transparent pricing

€33 per certificate

The ACME service fee is charged per main certificate per year. One fee covers up to 25 servers using that certificate, and each server gets its own reissued certificate at no extra cost.

SAN changes and reissues are exempt from the fee
Additional ACME clients using the same certificate: free
Standard certificate prices apply on top

Certificate Reuse: One Certificate, Many Servers

Do you have the same domain running on multiple servers, e.g., behind a load balancer, in a cluster, or with staging/production environments? You don't need to buy a certificate per server.

With FairSSL ACME, the certificate is managed centrally. When renewed, your ACME client automatically distributes it to all servers using it. You pay for the certificate, not the number of installations.

Scenario	Competitors	FairSSL
1 SAN certificate (www, api, mail), 5 servers	5 licenses	1 certificate
1 SAN certificate, 20 servers behind a load balancer	20 licenses	1 certificate
1 wildcard, 25 servers	25 licences	1 certificate

We sell certificates, not licenses per server. One certificate covers all servers it is installed on. With FairSSL ACME the fee is charged per main certificate, and one fee covers up to 25 servers.

Worked example: 30 servers, 10 certificates

A company with 30 servers spread across 10 certificates pays for 10 certificates plus 10 ACME fees, roughly €790 per year in total. There are no per-server licenses, and the price does not rise when certificates must be renewed more often.

Security without DNS keys on your servers

Many automation tools require a DNS API key on every server to issue certificates. If that key leaks, an attacker can change your DNS. With FairSSL AutoDNS the validation stays with us: your servers need neither DNS keys nor open ports.

We recommend certificates with named hosts (SAN) over wildcards, and you can enforce it: lock each ACME client to specific names and block wildcard issuance per profile.

Read about FairSSL AutoDNS → Compare with Let's Encrypt →

Built for engineers

"Set and forget" validation

Forget opening firewalls or handling temporary tokens. We use permanent DNS CNAME validation.

Your servers need no inbound internet access
Set the CNAME once, we handle validation automatically forever

Intelligent certificate reuse

Why pay for new certificates when you have 10 servers behind a load balancer?

The system reuses existing certificates across your infrastructure
Additional ACME clients using the same certificate are included in the ACME fee

No salespeople: just engineers

You are not talking to sales. You are talking to the developers who built the system.

No sales meetings, no "contact us for pricing", no upfront payments
Step-by-step guides for Windows (IIS), Linux and Kubernetes

Popular ACME Clients

Any ACME client that follows RFC 8555 and supports EAB works with FairSSL. Here are the clients we have tested and can help with.

Windows

IIS, Exchange, RDP, SQL Server, ADFS

simple-acme, Certify The Web, Posh-ACME

Linux

Apache, Nginx, HAProxy, Docker, Kubernetes

Lego, Certbot, acme.sh, Caddy

Overview

Network Appliances

FortiGate, FortiMail, FortiWeb, NetScaler, Kemp LoadMaster, Cisco ASA and FDM, Kubernetes cert-manager

FortiGate, NetScaler, Kemp, Cisco, Kubernetes

Cloud

Azure, AWS, Kubernetes cert-manager

Key Vault Acmebot, cert-manager

Our recommendation: simple-acme for Windows, Lego for Linux and CI/CD. FairSSL sponsors both projects. They have the best integration with the FairSSL ACME server and support ARI for intelligent renewal and monitoring.

Windows Setup → Linux & Kubernetes → Appliances and load balancers → ACME Clients →

Supported versions

The wizard in the control panel is written for these versions. If you run an older version than the one listed, ask us before you order.

Windows

Platform	Versions	Runs on	ACME client	Guide
IIS	VersionsIIS 8 and newer	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included)	Guide →
IIS (legacy)	VersionsIIS 6.0 to 7.5, the IIS binding is set by hand	Runs onWindows Server 2008 R2 or older	ACME clientAn older simple-acme release that still runs on Windows Server 2008 R2	Guide →
Exchange Server	Versions2013, 2016, 2019 and Subscription Edition	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportExchange.v3.ps1	Guide →
Remote Desktop Services	VersionsRD Gateway (also without an RD Connection Broker), RD Web Access, RD Web Client, RD Connection Broker and the RDP listener	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportRDSFullFairSSL.ps1	Guide →
Dynamics NAV / Business Central	VersionsNAV 2013 R2 and newer, every Business Central version (on-premises)	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportDynamicsNAV.ps1	Guide →
AD FS	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1	Guide →
Web Application Proxy	VersionsThe guide sets no version limit	Runs onWindows Server 2012 R2 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportADFS-WAP.v1.ps1	Guide →
SQL Server	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportSQL.ps1	Guide →
PRTG Network Monitor	VersionsThe guide sets no version limit	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportPRTG.ps1	Guide →
Apache Tomcat	Versions8.5, 9.x, 10.x and 11.x	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportTomcat.ps1	Guide →
Other Windows service	VersionsCertificate store, PFX or PEM, with your own script	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + ImportCustomWindows.ps1	Guide →
Several Windows servers	VersionsReceiving servers: Windows Server 2012 or newer with PowerShell 5.1 and WinRM	Runs onWindows Server 2012 or newer	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + DistributeToWindowsServers.ps1	Guide →

Linux

Platform	Versions	Runs on	ACME client
nginx	VersionsThe guide sets no version limit	Runs onLinux	ACME clientlego 5.0.4+
Apache	VersionsThe guide sets no version limit	Runs onLinux	ACME clientlego 5.0.4+
HAProxy	VersionsThe guide sets no version limit	Runs onLinux	ACME clientlego 5.0.4+
Traefik	VersionsWith the file provider	Runs onLinux	ACME clientlego 5.0.4+
Postfix	VersionsThe guide sets no version limit	Runs onLinux	ACME clientlego 5.0.4+
Caddy	VersionsThe guide sets no version limit	Runs onLinux	ACME clientCaddy’s built-in ACME with EAB
Other Linux service	VersionsThe guide sets no version limit	Runs onLinux	ACME clientlego 5.0.4+

macOS

Platform	Versions	Runs on	ACME client	Guide
macOS	VersionsThe guide sets no version limit	Runs onmacOS	ACME clientlego 5.0.4+	Guide →

Appliances

Platform	Versions	Runs on	ACME client	Guide
FortiGate	VersionsFortiOS 7.6.3 and newer	Runs onThe device itself	ACME clientThe device’s built-in ACME client with EAB	Guide →
FortiGate	VersionsFortiOS before 7.6.3	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + Posh-SSH, CredentialManager	Guide →
FortiGate	VersionsFortiOS before 7.6.3	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
FortiMail	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + Posh-SSH, CredentialManager	Guide →
FortiMail	VersionsThe guide sets no version limit	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
FortiWeb	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + FortiWeb REST API, CredentialManager	Guide →
NetScaler ADC	VersionsThe guide sets no version limit	Runs onWindows Server 2016 or newer, or 2012/2012 R2 with WMF 5.1 (PowerShell 5.1)	ACME clientsimple-acme 2.4.0+ (FairSSL edition, .NET 10 included) + NITRO API, CredentialManager	Guide →
F5 BIG-IP	VersionsBIG-IP 21.1.0 and newer	Runs onThe device itself	ACME clientThe device’s built-in ACME client with EAB	Guide →
Kemp LoadMaster	VersionsLMOS 7.x and newer	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+	Guide →
Cisco FDM (Firepower)	VersionsFTD 6.4+	Runs onA Linux server that pushes the certificate to the device	ACME clientlego 5.0.4+
Cisco ASA and devices without EAB	VersionsThe guide sets no version limit	Runs onThe device itself	ACME clientThe device’s built-in ACME client with a single-use enrollment URL, no EAB	Guide →
Kubernetes	VersionsThe guide sets no version limit	Runs onThe Kubernetes cluster	ACME clientcert-manager, ARI from v1.21 with the ACMEUseARI feature gate	Guide →

Comparison with free ACME services

See the difference between FairSSL ACME, Let’s Encrypt and ZeroSSL.

Scroll right to see more providers

Feature	FairSSL	Let's Encrypt	ZeroSSL
Certificate types	DV (RapidSSL, Thawte SSL123)	DV	DV (free), OV/EV (paid)
Certificate validity	1–199 days	90 days (6 days announced)	90 days
Permanent DNS validation (DNS-PERSIST-01)	✓ One record, instant issuance (DigiCert brands)	Announced, staging only	✗
Supports multiple CAs	✓	✗	✗
ACME client monitoring	✓	✗	✗
Expiry alerts & reports	Email lists, daily/weekly/monthly	✗	Expiry email
Certificates per domain	No limit	50 per week	3 free, then paid
Duplicate certificates	1,000	5 per week	Limited
Names per certificate (SANs)	250	100	100
Wildcards allowed	✓	✓ (requires DNS API key)	✗ (paid only)
DNS validation	AutoDNS — set and forget	Requires DNS API key on client	Requires DNS API key on client
Centralised management	✓	✗	Basic dashboard
Per-profile wildcard control	✓	✗	✗
Per-client SAN locking	✓	✗	✗
Order period	1–3 years	No order, 90 days at a time	90 days (free), 1 year (paid)
Installation guides	✓ Step-by-step	Community documentation	Help articles
Debug event log	✓ Full traceability	✗	✗
Support	Phone & email	Community forum	Email

See the full comparison with pricing scenarios →

ACME server details

ACME directory URL: https://fairssl.dk/acme
Protocol: ACME v2 (RFC 8555), ARI (RFC 9773)
Account binding: EAB (preferred) or a custom URL for appliances without EAB
Certificate types: DV and OV, including SAN and wildcard. EV only through GlobalSign, pre-validated
Certificate authorities: DigiCert, RapidSSL, Thawte and GeoTrust through their API. GlobalSign OV and EV pre-validated through theirs. Sectigo is not issued through automation
Automation fee: €33 per certificate/year, on top of the certificate price (250 DKK for invoicing in Danish kroner, 370 SEK in Swedish kronor)
Fee unit: Per main certificate per year. Up to 25 servers using that certificate are included
DNS validation: AutoDNS: no DNS keys, no open ports
Persistent domain validation: DNS-PERSIST-01 (CA/Browser Forum), DigiCert brands

Get started from the control panel

Create a free account, or log in to the control panel.
Choose SSL Automation and the platform the certificate is for, such as IIS, nginx or a FortiGate.
Enter the domains. The control panel generates the command or configuration with your key and the server address.
Copy it and run it on the server. Add one CNAME for AutoDNS and no inbound ports need to be opened.

Go to the control panel →

The command carries your EAB key, so the client is bound to your account. Renewal and monitoring then run on their own.

ACME-compatible certificates

These DV certificates support automatic ACME issuance and renewal:

RapidSSL

Standard DV. Issued in minutes.

from €46 /year See details →

Thawte SSL123 SAN DV

DV multi-domain. Supports SAN names and wildcards in combination.

from €86 /year See details →

See all products with prices →

Certificates on many servers and appliances

A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.

How sslbrain renews and installs certificates automatically

Frequently asked questions about ACME automation

Find answers to the most common questions about SSL certificates and FairSSL.

What does ACME cost at FairSSL?

The ACME service fee is €33 per main certificate per year, on top of the certificate price. One fee covers up to 25 servers using that certificate, and each server gets its own reissued certificate free. SAN changes and reissues are exempt, and additional ACME clients on the same certificate are free. A separate certificate is priced from scratch: its own price plus the fee.

When do SSL lifetimes change?

The CA/Browser Forum adopted a phased reduction in 2025 (SC-081): 200 days, 100 days from 15 March 2027 and 47 days from 15 March 2029. In practice the dates are earlier and the numbers a day lower, because each CA stops ahead of the rule and issues with a day of headroom. At the CAs we automate that means 199 days now, 99 days from 24 February 2027 and 46 days from 24 February 2029. Without automation, it becomes an administrative nightmare.

Does SSL cost more as certificate lifetimes get shorter?

No. You pay for an order period, typically one year, and the price stays the same no matter how many times the certificate is reissued within that period. Since 15 March 2026 certificates must be replaced more often, and from 24 February 2027 more often still, but every reissue is included in the price. With SSL Automation from FairSSL, renewal happens automatically.

Do I need to change anything now?

If you already use ACME (Certbot, simple-acme, acme.sh) and renew automatically, you are well positioned. If you renew manually, you should migrate to ACME now.

Can I get OV certificates through SSL Automation?

Yes. Automation issues DV and OV from DigiCert, RapidSSL, Thawte and GeoTrust through their API, as single-domain, SAN and wildcard. GlobalSign OV and EV are issued pre-validated through GlobalSign's API. DigiCert EV is not included, because it requires email approval when ordered through the API. Sectigo is not issued through automation; order those in the control panel.

Can I use ACME with Kubernetes and cert-manager?

Yes. cert-manager supports ACME with External Account Binding (EAB) and can be configured to point at the FairSSL ACME server.

Does FairSSL have rate limits?

No limits on the number of paid certificates per domain, up to 1,000 duplicates and 250 names (SANs) per certificate. We have high request rate limits to prevent errors and misuse, but they do not affect normal operations. Perfect for disaster recovery, scaling and large installations.

Ready to create a free account?

Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.

Create free account Compare certificates