# The zerossl.com CA is supported by acme.sh **URL:** \ **Category:** Client dev\ **Created:** [August 12, 2020, 2:41pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894 "2020-08-12T14:41:29Z")\ **Posts on this page:** 19\ **Page:** 1
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [August 12, 2020, 2:41pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/1 "2020-08-12T14:41:29Z")
[Zerossl.com](http://Zerossl.com) is another ACME compatible CA. It supports unlimited free certs, including SAN cert and Wildcard certs. (ECC certs will be online soon) And acme.sh just supported [zerossl.com](http://zerossl.com). See the usage: > **[acmesh-official/acme.sh](https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA)** > > A pure Unix shell script implementing ACME client protocol - acmesh-official/acme.sh ---
**Author:** ![rmbolger](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rmbolger/32/27474_2.png) [@rmbolger](https://community.letsencrypt.org/u/rmbolger)\ **Post date:** [August 12, 2020, 6:42pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/2 "2020-08-12T18:42:32Z")
> [@Neilpang](#): > > It supports unlimited free certs The [pricing](https://zerossl.com/pricing/) page seems to indicate you can only get up to 3 non-wildcard certs for free. ---
**Author:** ![Rip](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rip/32/70863_2.png) [@Rip](https://community.letsencrypt.org/u/Rip)\ **Post date:** [August 12, 2020, 7:23pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/3 "2020-08-12T19:23:33Z")
@Neilpang Thanks to _your_ efforts, **acme.sh** continues to expand and improve. **It is an awesome script**. I don’t think much about this particular CAA, but adding this functionality to acme.sh is forward thinking and a good move. **Excellent Work**. Rip ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [August 12, 2020, 10:12pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/4 "2020-08-12T22:12:38Z")
> [@rmbolger](#): > > The [pricing](https://zerossl.com/pricing/) page seems to indicate you can only get up to 3 non-wildcard certs for free. I saw something from them in chat which might suggest that could change? Not sure whether it's more about removing EAB requirement, or loosening up the certificate constraints: > We now have a working ACME server at [https://acme.zerossl.com/v2/DV90](https://acme.zerossl.com/v2/DV90) . We are working with our upstream certificate provider to open it up completely, but for now it requires EAB credentials. Anyway, it makes sense for acme.sh to have first class support for ZeroSSL - apilayer does own them both. The more ACME, the merrier. If we get to a point where there's a reasonable choice between providers, even if many are commercial, I think that is going to be a positive. ---
**Author:** ![rmbolger](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rmbolger/32/27474_2.png) [@rmbolger](https://community.letsencrypt.org/u/rmbolger)\ **Post date:** [August 12, 2020, 10:34pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/5 "2020-08-12T22:34:48Z")
> [@\_az](#): > > apilayer does own them both. Wait, really? apilayer took over acme.sh? The GitHub repo still appears to be owned by @Neilpang. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [August 12, 2020, 11:32pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/6 "2020-08-12T23:32:43Z")
I had forgotten about that, but it happened back in January: > ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [August 13, 2020, 12:05am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/7 "2020-08-13T00:05:39Z")
I didn’t know this either. I vent looking for acme.sh’s license, and I found a GPLv3, but no license notice that would tell me who the copyright holder is. Now that it has a full company behind I can complain about missing features without feeling like an asshole. I really don’t understand why doesn’t apilayer advertise these acquisitions. On their website, they’re not there. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [August 13, 2020, 12:10am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/8 "2020-08-13T00:10:59Z")
> [@9peppe](#): > > On their website, they’re not there. Might be [ACME Automation - ZeroSSL](https://zerossl.com/features/acme#clients) Not clear what it exactly means though ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [August 13, 2020, 12:12am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/9 "2020-08-13T00:12:22Z")
No, I mean… [https://apilayer.com/#products](https://apilayer.com/#products) Where’s the acme stuff? Where’s even the CA stuff? ---
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [August 13, 2020, 1:17am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/11 "2020-08-13T01:17:31Z")
The pricing page is for UI users. There is no limitation upon ACME clients. ---
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [August 13, 2020, 1:20am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/12 "2020-08-13T01:20:07Z")
Yes, apilayer bought acme.sh project, but I’m the only maintainer. And the project license is not changed. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [August 13, 2020, 1:55am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/13 "2020-08-13T01:55:37Z")
> [@Neilpang](#): > > The pricing page is for UI users. There is no limitation upon ACME clients. Thanks for clarifying Neil, that's really good to hear. I was able to issue a multi-domain wildcard certificate using a free ZeroSSL account and the EAB credentials it gave me, worked like a charm! ---
**Author:** ![felixf](https://avatars.discourse-cdn.com/v4/letter/f/fbc32d/32.png) [@felixf](https://community.letsencrypt.org/u/felixf)\ **Post date:** [September 6, 2020, 7:27pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/14 "2020-09-06T19:27:29Z")
I’ve been toying around with supporting ZeroSSL for the ACME client I’m working on (Ansible’s acme\_certificate module) around three weeks ago, and had some problems. I’ve tried contacting ZeroSSL’s support, but so far I only got two automatic replies (_“We are really sorry for the delay in response, but due to the recent re-launch of the ZeroSSL platform our support team is really busy. / Today we launched a new self-service Help-Center which should give you the answers to your questions.”_ - I really wonder whether any of these two dates is actually the “today” from that sentence). Maybe someone here (@Neilpang?) has a better contact to their team, so here are my problems: 1. Bug: when not passing a contact email when calling the newAccount endpoint, the error `urn:ietf:params:acme:error:externalAccountRequired` is returned. (This kept me looking at my EAB code for a couple of hours until I figured out that it’s just the error message that’s wrong.) 2. Improvement: it would be good if no contact is required if `"onlyReturnExisting": true` is passed to the `newAccount` endpoint. 3. Improvement: when successfully validating a challenge for a one-domain order and calling `finalize` while the CAA does not allow [zerossl.com](http://zerossl.com) to issue a certificate, the order object’s state changes to `invalid` without any error message. A helpful error message would be a lot better. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 6, 2020, 7:56pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/15 "2020-09-06T19:56:59Z")
Perhaps try send it to Sectigo support as well? A bit closer to the people who need to see it. Nice finds. ---
**Author:** ![felixf](https://avatars.discourse-cdn.com/v4/letter/f/fbc32d/32.png) [@felixf](https://community.letsencrypt.org/u/felixf)\ **Post date:** [September 6, 2020, 8:18pm UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/16 "2020-09-06T20:18:20Z")
@az\_ is [zerossl.com](http://zerossl.com)’s ACME server operated by Sectigo, or do they use Sectigo ACME server software? I was not able to find information on that anywhere. ---
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [September 7, 2020, 1:15am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/17 "2020-09-07T01:15:36Z")
I will try to forward your comment to Zerossl team. Thanks. ---
**Author:** ![dspd](https://avatars.discourse-cdn.com/v4/letter/d/f17d59/32.png) [@dspd](https://community.letsencrypt.org/u/dspd)\ **Post date:** [September 7, 2020, 7:51am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/18 "2020-09-07T07:51:08Z")
Thanks a lot for the detailed report about the bug with the error message as well as the two suggestions for improvement. I’ll forward these to our partner (Sectigo). Best, David (ZeroSSL) ---
**Author:** ![felixf](https://avatars.discourse-cdn.com/v4/letter/f/fbc32d/32.png) [@felixf](https://community.letsencrypt.org/u/felixf)\ **Post date:** [September 7, 2020, 8:03am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/19 "2020-09-07T08:03:10Z")
@Neilpang @dspd thanks a lot! 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 7, 2020, 8:03am UTC](https://community.letsencrypt.org/t/the-zerossl-com-ca-is-supported-by-acme-sh/130894/20 "2020-10-07T08:03:26Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.