Multi-CA
One certificate workflow across multiple certificate authorities.
One application model. Provider-specific implementation stays behind the platform. You select a provider on the order. We do not automatically fail over to any CA.
How selection works
POST /api/v1/certificates accepts optional provider. Default auto uses the platform default driver — sandbox unless ACME is enabled. Connecting a commercial CA account in the directory lets you name that authority at order time. domains, validation, key_mode and auto_renew do not change.
Commercial and free CA architecture
Let’s Encrypt has no CA fee. Sandbox is for integration. ZeroSSL, SSL.com, Sectigo, DigiCert, GlobalSign and others appear as customer-connectable integrations. Connecting an account is not a claim that every OV/EV product is self-serve, or that rate limits and CAA are interchangeable.
Failover — read this twice
After a DNS-01 challenge is published, swapping the CA would break validation. CAA may forbid the next issuer. That issuer may need a different account, product type or EAB. Therefore: no automatic failover to any CA. Create a new order and choose again.
Central inventory
Whatever CA signed the leaf, it lands in the same organization list, the same 30-day renewal scheduler, and the same webhooks.
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
Can I pick a CA per order?
Yes. POST /certificates accepts provider. The default auto uses the platform default driver.
Do you fail over automatically?
No. After challenges are presented, a new CA needs a new order. CAA, account credentials, product type and rate limits are not interchangeable.
Which CAs can customers connect?
Let’s Encrypt (when ACME is enabled), sandbox always, and commercial accounts listed in the certificate-authority directory — ZeroSSL, SSL.com, Sectigo, DigiCert, GlobalSign and others. Connecting is not the same as every product being self-serve DV.
Does the API change per CA?
No. domains, validation, key_mode and auto_renew stay the same. Provider-specific implementation stays behind the platform.
Where do commercial fees show up?
On invoices after you connect that authority and issue through it. Let’s Encrypt has no CA fee.
Is sandbox a CA?
It is the default driver so you can integrate. It is not a publicly trusted authority. Do not serve sandbox leaves to production users.
Pick the CA on the order, not in five SDKs.
Start on sandbox. Enable ACME when the account is ready. Connect a commercial CA only with credentials you already have.