Private keys vs customer CSR
Choose platform-generated keys when you want the API to hold the secret, or CSR mode when the key never leaves your HSM.
Answer first
Choose platform-generated keys when you want the API to hold the secret, or CSR mode when the key never leaves your HSM.
How the platform treats it
CSR mode never transmits the private key. Generated mode encrypts it at rest and audits downloads.
Operational checklist
Confirm the hostname or product is in the correct organization. Prefer scoped credentials. Record the audit event. Subscribe to the matching webhook. Do not enable production ACME from a guide.
Failure modes
Expect DNS propagation delay, CA rate limits, and expired tokens. The API returns stable error codes rather than HTML error pages. Retry with backoff; do not loop validate calls from a browser tab.
Related inventory
After a successful change, inspect certificates, orders, deployments and billing documents. Unexpected Certificate Transparency entries are observations, not compromise claims.
Sources and limits
This guide describes software behavior. It is not legal, tax or CA-policy advice. Provider capabilities are cited from official documentation and fact-checked in admin content. Fact-check date: 2026-09-19.