Quick Start

Download PKI Trust Manager, issue your first certificate, and automate renewal - in about ten minutes.

This quick start gets a certificate issued by PKI Trust Manager in about ten minutes using the free Community Edition (up to 500 certificates).

1. Get PKI Trust Manager#

2. Create an ACME application#

  1. Open the Web Admin UI and go to Integrations → New.
  2. Set Type to ACME.
  3. Set the Domain to the ACME hostname clients will use (must match the Host header - no port).
  4. Pick a Certificate template bound to your CA.
  5. Set Require domain validation to Off to auto-pass challenges, or On for http-01 / dns-01.

3. Create an ACME (EAB) user#

  1. Go to Users → Create, and choose type ACME.
  2. The UI generates two values - save them:
    • Key ID (KID)
    • HMAC key
  3. These are your client EAB credentials (--eab-kid / --eab-hmac-key).

4. Issue a certificate with acme.sh#

# install (one time)
curl https://get.acme.sh | sh
 
# issue against your ACME directory
~/.acme.sh/acme.sh --issue \
  --server https://acme.example.com/acme/directory \
  -d acme.example.com \
  --eab-kid YOUR_KID \
  --eab-hmac-key 'YOUR_HMAC_KEY' \
  --webroot /tmp/acme-webroot \
  --keylength 2048 \
  --force

Your certificate lands in ~/.acme.sh/acme.example.com/ and renews automatically.

5. Verify#

openssl x509 -in <cert-file> -noout -subject -issuer -dates -ext subjectAltName

In the Web Admin UI, the enrollment appears in Certificates with status Issued.

Next steps#