Skip to content

Certificate authorities

Adapters exist for Let’s Encrypt, ZeroSSL, SSL.com, Sectigo, DigiCert and GlobalSign. An adapter is not a live integration. Sandbox issuance is the default. Production ACME stays off until an operator enables it.

Capability states

Every provider is labeled available, available with your account, beta, test mode, or unavailable. Internally we also track code, contract tests, credentials, connection, live E2E, and customer enablement. Compatible with these CAs is not a partnership claim.

What we do not claim

No official partnership. Live commercial issuance needs that CA’s account and a proven E2E run.

Capability state

An adapter is not the same as a live integration. Customer-facing state never says live just because code exists.

Name State Wording Live E2E
Sandbox CA test mode Works with no
Let's Encrypt test mode Works with no
ZeroSSL unavailable Compatible with no
SSL.com unavailable Compatible with no
Sectigo unavailable Compatible with no
DigiCert unavailable Compatible with no
GlobalSign unavailable Compatible with no
Manual DNS-01 available Works with yes
Cloudflare DNS unavailable Integrates with no
Amazon Route 53 unavailable Integrates with no
Azure DNS unavailable Integrates with no
Google Cloud DNS unavailable Integrates with no
DigitalOcean DNS unavailable Integrates with no
Hetzner DNS unavailable Integrates with no
Plesk DNS unavailable Integrates with no
cPanel DNS unavailable Integrates with no
Plesk unavailable Compatible with no
cPanel unavailable Compatible with no
nginx unavailable Compatible with no
Apache unavailable Compatible with no
Kubernetes unavailable Compatible with no
AWS unavailable Compatible with no
Stripe test mode unavailable Integrates with no
Stripe live mode unavailable Integrates with no
VAT / tax engine test mode Works with no