Sectigo Certificate as a Service (CaaS) for Partners
Pay per domain. Issue without limits. Automate and grow—across DV, OV, EV, and eIDAS QWAC certificates.
Sectigo CaaS revolutionizes how partners manage and monetize digital certificates
The SSL/TLS certificate market is booming, projected to hit $4.2 billion by 2028. With shorter certificate lifespans like 47-day TLS becoming soon the new norm, managing certificates manually isn't just time-consuming—it's unscalable. But with Sectigo CaaS for Partners, you can turn these challenges into opportunities.
Designed specifically for partners, Sectigo CaaS empowers you to automate certificate management, streamline operations, and deliver seamless, secure experiences for your customers. Deliver DV, OV, EV SSL/TLS, and eIDAS QWACs—all through a single management API and domain-based subscription model.
Grow your certificate business with a subscription model
Move from per-certificate sales to per-domain subscriptions to eliminate renewal complexity and deliver unlimited certificates per domain—automatically. Manage up to 12x more certificates without increasing your staff. Whether you’re issuing certificates to customers or managing your own internal operations, our automated platform helps eliminate human error, reduces downtime, and frees your team to focus on what matters most—growing your business.
Key benefits of Sectigo CaaS for Partners
Control customer accounts
Get control how your customers issue certificates under your subscription with seamless ACME account oversight and reporting, ensuring control without complexity.
Increased customer stickiness
Move beyond transactional sales and improve customer retention.
Scale up your business
Easily handle the growing demand for SSL/TLS certificates as your customer base expands. Sectigo CaaS is designed to support high volumes without compromising on speed or security.
Predictable pricing & increased profits
Move away from the uncertainty of one-off purchases to our per-domain subscriptions with predictable costs, helping you plan and grow your revenue.
Security and compliance
Ensure compliance across evolving standards—including 47-day TLS readiness, post-quantum transitions, and support for regulated certificate types like eIDAS QWACs.
Seamless integration
Plug subscription and account management into your existing systems with our flexible ACME Admin API, designed to scale with your business needs.
Flexible subscription models to fit your customers
Pay-per-domain subscriptions
- Add domains anytime
- Unlimited 90-day certificates per domain
- One renewal cycle per subscription
Domain subscription bundles
- Pre-purchase domain capacity
- Allocate domains as needed and issue unlimited 90-day certificates
- Simplify procurement for customers needing upfront quoting
Get started, see how easy it is
ACME automation guarantees high value and low effort:
- You manage your subscriptions & ACME accounts with a single admin API endpoint
- Your customers just need to setup the ACME client
- No more copying or pasting of CSRs, manual validations, email delays, or yearly renewal reminders
- Minimal IT resources required
FAQ
Ready to start
Right away. You just need to have a Sectigo Partner account set up with CaaS enabled. Please contact our Partner Sales team via [email protected] to assist in set up.
Please contact our Partner Sales team via [email protected] to assist in your Partner account setup.
The CaaS API specifications can be found here: https://docs.sectigo.com/caas/caas-api-guide/introduction-to-caas.html
Pricing
CaaS is priced as a yearly or multi-year subscription. The benefit of using CaaS does not significantly increase the current equivalent yearly cost of a certificate.
We work with our partners on a tiered basis, with respect to number of clients and certificates managed.
All listed options are available in CaaS.
A domain subscription needs to be purchased and is Priced per Fully Qualified Domain Name (FQDN) or wildcard domain name. An unlimited number of single-domain and multi-domain certificates, including wildcard certificates, can be requested for the subscribed domains during the subscription period.
If *.sectigo.com is added to the subscription and then sectigo.com, only a wildcard domain cost will be charged. www.sectigo.com is covered by the wildcard domain.
If sectigo.com is added to the subscription and then www.sectigo.com, the cost of only one FQDN will be charged.
Even with a few certificates, the manual task of copying and pasting CSRs and manual domain validation is no one’s favourite task on their to-do list. It also presents the risk of human error when doing this routinely, especially as certificate lifespans continue to shrink. Our prices are competitive – please reach out to our Partner Sales team at [email protected] for a price offer.
Compliance
47-day SSL/TLS certificates will be the new standard in 2029.
The newly approved measure, initially proposed by Apple and endorsed by Sectigo in January 2025, will gradually reduce certificate lifespans from the current 398 days to 47 days through a phased approach. Ballot SC-081v3 formally passed on April 11th, 2025, putting the phased reduction into effect with the following enforcement dates:
- March 15, 2026: Maximum certificate lifespan reduced to 200 days
- March 15, 2027: Further reduction to 100 days
- March 15, 2029: Final enforcement of the 47-day maximum lifespan
Private CAs and certificates are generally out of scope for these changes, but some trust-store operators (Apple) have historically limited private TLS certificates to 825 days. The current CA/Browser Forum ballot does not cover private certificates at all. As a reminder, CaaS covers publicly-trusted certificates.
The existing APIs and certificate provisioning processes will remain unchanged. Once shorter certificate lifetimes are required, this will be enforced in Sectigo systems, in the same way we made this change when moving from 3 to 2 and 1-year certificates.
General
Available certificates include: Domain Validation (DV) certificates, Organization Validation (OV) certificates, Extended Validation (EV) certificates and eIDAS QWAC (Qualified Website Authentication Certificate compliant with the EU eIDAS Regulation).
Support for OV will be added to CaaS soon. The organization will need to be pre-validated and tied to the right domain(s) prior to certificate enrolment. Once validated, an OV certificate request will result in issuing the certificate containing the pre-validated organization details tied to the domain(s) the certificate is requested for, once domain validation is completed.
This will allow access to an unlimited amount of OV certificates containing the pre-validated organization’s details obtained during the subscription period.
Yes, the TLS certificates issued through CaaS can include wildcard domains.
The answer depends on what "client" implies:
If the client is an ACME client, one subscription can be utilized by multiple ACME clients using ACME accounts that share the External Account Binding (EAB) details. An ACME client can operate multiple ACME accounts; however, not with a typical command-line ACME client.
If the client is a customer, selling one subscription for each customer makes perfect sense. However, you can also opt for selling multiple subscriptions to your customer by "releasing" multiple EAB details to them (if needed). Each EAB details have their own subscription that will need to be managed separately.
One subscription should not be shared by different customers.
Installation and use of an ACME client requires sufficient permissions to install and run the client, as well as access to the webserver or DNS, and the ability to restart some services (if installation is also required and supported by the client). In a situation where none of these prerequisites can be met, then CaaS (and any ACME CA) would not be supported.
An eIDAS Qualified Website Authentication Certificate (QWAC) is an SSL/TLS certificate issued to a verified organization in accordance with the EU eIDAS regulation. It is issued by Sectigo as a Qualified Trust Service Provider (QTSP) listed in the EU Trusted List. It confirms the identity of the organization behind a website and enables secure, encrypted communication, helping businesses meet EU requirements for trusted website authentication.
With QWAC support in Sectigo’s ACME-enabled CaaS solution, customers can automate certificate issuance and renewal, making it easier to maintain compliance as certificate lifespans shorten.
Technical
ACME offers a few different methods of domain validation. Sectigo supports DNS-based validation method with dns-01 in ACME and HTTP-based method with http-01.
ACME protocol does not support email-based validation, as it is not automatable.
The communication between ACME client and ACME sever is performed in accordance with ACME protocol documented in https://datatracker.ietf.org/doc/html/rfc8555.
No, they don’t expire. ACME EAB credentials are just used during ACME account creation as indication of your approval to bind this ACME account to your Sectigo Partner account, as well as your approval of the ACME account key.
The EAB credentials that we offer can be reused. If your customer has multiple servers or multiple clients, they can reuse those credentials to create multiple ACME accounts. They will share the same subscription and domains that they can issue certificates for.
Get started today
Ready to revolutionize your certificate management? Book a personalized demo of Sectigo CaaS and discover how our platform can transform your operations and drive new revenue streams.