Request an SSL Certificate with ZeroSSL

ZeroSSL offers certificate issuance through a web interface and ACME integrations. Free certificate availability, domain coverage, and quotas depend on the issuance channel and account plan. This guide explains the request, validation, and automation workflow.

1. About ZeroSSL

1. Platform features

Free certificate issuance:

• Offers a free DV certificate option, subject to the applicable plan and issuance channel.
• 90-day certificate validity
• Supports automated management through ACME.
• Issues certificates intended for compatibility with major browsers.

Certificate options:

• Single-domain certificates
• Multi-domain certificates, subject to plan and issuance channel
• Wildcard certificates, subject to plan and issuance channel

Validation:

• HTTP validation
• DNS validation
• Email validation where available

ACME support:

• Supports ACME v2.
• Works with clients such as acme.sh and Certbot.
• Also provides an API.

2. Use cases

• Personal websites and blogs
• Small business websites
• Projects eligible for a free certificate
• Workflows that require ACME automation

2. Register and sign in

1. Create an account

Visit the ZeroSSL website and click "Sign Up":

• Enter your email address
• Set a password
• Complete email verification

2. Sign in

Sign in with the email address and password used to create your account.

3. Request a free certificate

1. Create a request

1. Open "SSL Certificates" after signing in.
2. Click "New Certificate".
3. Select an available certificate option and check its lifetime and price before proceeding.

2. Enter domain details

• Enter the domain to certify
• For example, www.example.com or example.com
• Check the domain coverage and quota included in your plan.

3. Select a validation method

The dashboard may offer the following validation methods, depending on the certificate and applicable requirements:

HTTP validation:

• Create a validation file on the web server
• Suitable when you can configure the web server

DNS validation:

• Add a TXT record through your DNS provider
• Suitable when you cannot create files on the server

Email validation:

• Send a validation message to an eligible domain contact address.
• Follow the link in the message to complete validation.

4. Complete validation

HTTP validation:

1. View the required file path and contents
2. Create the challenge file on the server
3. Ensure public HTTP access to the file
4. Click "Verify Domain" to complete validation.

DNS validation:

1. View the required TXT record
2. Add it with your DNS provider
3. Wait for propagation, usually a few minutes
4. Click "Verify Domain" to complete validation.

Email validation, where available:

1. Select an eligible domain contact address.
2. Request the validation email.
3. Follow the verification link in the message.
4. Complete validation

5. Download the certificate

After validation and issuance, download:

• Certificate file
• Private key file
• Certificate chain file

4. Automated Issuance with ACME

1. Use acme.sh

Install acme.sh:

curl https://get.acme.sh | sh

Request a certificate:

# Use HTTP validation
~/.acme.sh/acme.sh --issue -d example.com --webroot /var/www/html

# Use DNS validation, with Cloudflare as an example
export CF_Email="your-email@example.com"
export CF_Key="your-api-key"
~/.acme.sh/acme.sh --issue -d example.com --dns dns_cf

Install a certificate:

~/.acme.sh/acme.sh --install-cert -d example.com \
  --key-file /path/to/key.pem \
  --fullchain-file /path/to/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

2. Use Certbot

Install Certbot:

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install certbot

# CentOS/RHEL
sudo yum install certbot

Request a certificate:

# Use HTTP validation
sudo certbot certonly --webroot -w /var/www/html -d example.com

# Use DNS validation
sudo certbot certonly --manual --preferred-challenges dns -d example.com

3. Configure automatic renewal

acme.sh automatic renewal: A standard acme.sh installation creates a cron job that checks certificates and renews them when eligible.

Certbot automatic renewal:

# Test automatic renewal.
sudo certbot renew --dry-run

# Check the renewal scheduler installed with Certbot

Certificate configuration

1. NGINX configuration

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;
    ssl_trusted_certificate /path/to/chain.crt;
    
    # TLS configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Add the remaining site configuration here.
}

2. Apache configuration

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.crt
    
    # TLS configuration
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite HIGH:!aNULL:!MD5
    
    # Add the remaining site configuration here.
</VirtualHost>

6. Certificate renewal

1. Manual renewal

Before expiration:

1. Sign in to ZeroSSL.
2. Locate the certificate
3. Click "Renew".
4. Complete validation again
5. Download and deploy the replacement

2. Renewal automation

ACME clients can automate renewal:

• acme.sh can renew certificates automatically.
• Certbot can be configured for scheduled renewal.
• Renew certificates before they expire.

7. API Usage

1. Obtain an API Key

1. Sign in to ZeroSSL.
2. Open the developer settings.
3. Create an API key.
4. Store the API key securely.

2. Request a Certificate Through the API

# Create a certificate request
curl -X POST https://api.zerossl.com/certificates \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "certificate_domains=example.com" \
  -d "certificate_validity_days=90" \
  -d "certificate_csr=$(cat csr.txt)"

3. Validate the Domain

# HTTP validation
curl -X POST https://api.zerossl.com/certificates/{id}/challenges \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "validation_method=HTTP_CSR_HASH"

8. Common issues

1. Validation fails

Possible causes:

• DNS changes have not propagated
• Inaccessible HTTP challenge file
• Validation timed out

Resolution:

• Check DNS resolution
• Check the HTTP challenge path
• Wait for DNS propagation, then retry

2. Download fails

Possible causes:

• Issuance has not completed successfully
• Network problems

Resolution:

• Inspect the certificate
• Retry the download
• Check network connectivity

3. Free Certificate Limits

Limits to check:

• Domain coverage and quotas depend on the plan and issuance channel.
• 90-day certificate validity
• Certificates must be renewed before expiration.

Options:

• Automate renewal with an ACME client.
• Review paid plans if you need different quotas or features; a subscription does not eliminate certificate renewal requirements.

9. Comparison with CertOne

1. Feature comparison

Feature	ZeroSSL	CertOne
Free issuance	Subject to plan and issuance channel	Single-domain, multi-domain, and wildcard Let's Encrypt certificates
Certificate lifetime	Check the issued certificate	Check the issued certificate
Automatic renewal	⚠️ ACME client setup	✅ Platform automation
Automatic deployment	❌	✅
Certificate monitoring	❌	✅
Multi-domain certificates	Availability depends on plan and issuance channel	Free Let's Encrypt issuance
Wildcard certificates	Availability depends on plan and issuance channel	Free Let's Encrypt issuance

2. Use cases

ZeroSSL may suit users who:

• Need only single-domain certificates
• Are familiar with ACME
• Can configure their own renewal automation

CertOne suits users who:

• Need multi-domain or wildcard certificates
• Need automated management
• Need automated deployment and monitoring

Conclusion

ZeroSSL offers certificate issuance and ACME integrations. Check the applicable plan and issuance channel, then configure validation and renewal for your environment.

For integrated renewal, deployment, and site monitoring, CertOne provides a broader certificate management workflow, including multi-domain and wildcard issuance. Automation and monitoring features use account credits as described in the pricing documentation.

Automate your certificates with CertOne ↗

Issue free SSL/TLS certificates and automate renewal, deployment, and monitoring with CertOne. Connect your cloud services, servers, and containers from one dashboard.