This article describes how to use our ACME-enabled SSL certificate and our DNS Service with Certify The Web (a commercial SSL/TLS certificate management tool) using the Certify DNS cloud-hosted service.  

• Sectigo ACME Endpoint: https://acme.sectigo.com/v2/DV
• Sectigo EAB Credentials: The External Account Binding Key ID (KID) and HMAC Key found in your DDNS certificate order.
• Certify DNS License Key: The license key purchased under your Certify The Web Profile.

1. Open Certify Certificate Manager.
2. Navigate to Settings > Certificate Authorities.
3. Click Add New ACME Account or select Sectigo from the built-in CA list.
4. Go to the Advanced tab in the account dialog.
5. Check the box for External Account Binding (EAB) and enter your Sectigo KID and HMAC Key.
6. Click Save/Register to link the client to your Sectigo account.

1. Go to Settings > Stored Credentials in the Certify app.
2. Add a new credential and choose Certify DNS as the provider.
3. Enter your Account Email Address as the API Username.
4. Enter your Certify DNS License Key as the API Key. Save the credentials.

1. Click New Certificate in the main dashboard.
2. Select your site or manually add the domains / wildcards you want to secure.
3. Under the Certificate > Advanced tab, explicitly select Sectigo as your Certificate Authority (if it is not your default).
4. Move to the Authorization tab:
   • Change the challenge type to DNS-01.
   • Select Certify DNS as the DNS update method.
   • Select the Certify DNS credential you stored in Step 3.

1. Click Request Certificate to trigger the initial registration workflow.
2. The initial request will pause or prompt you, generating a unique alias URL.
3. Log into your Plesk hosting control panel.
4. Go to DNS Settings, Add record, select CNAME as the type:
   • Name: _acme-challenge.yourdomain.com
   • Target: (The unique .certifydns.com string provided by the app log)
5. Delete any old, conflicting _acme-challenge TXT records in your zone.

1. Return to Certify The Web and hit Request Certificate again.
2. Sectigo will ask for validation → Certify DNS will host the TXT token dynamically → Sectigo will issue the SSL certificate.
3. The certificate will auto-bind to your web server (such as IIS or Nginx)

From this point forward, renewals are completely hands-free. Sectigo will routinely call the ACME endpoint, and Certify DNS will handle the DNS records automatically over the CNAME without ever needing access to your main DNS registrar account.