Certificate as a Service (CaaS) is built around automation, where a client on your server requests and replaces each SSL Certificate without anyone being involved. Some machines cannot run that client at all.
The hosted issuance tool reaches the same end result by a different route. It issues a real SSL Certificate from your existing Certificate as a Service (CaaS) license through four steps in a browser, with nothing to install and nothing to run on your own equipment.
What you receive is exactly what an automated client would have produced within your own environment. Only the method differs.
It performs the same role as an Automated Certificate Management Environment (ACME) client, hosted by Trustico® and operated on your behalf rather than installed on your own equipment.
You supply your credentials, prove control of your domain names, and download the finished files. Explore Certificate as a Service 🔗
Intended Users
This tool is for customers holding a Certificate as a Service (CaaS) license who need an SSL Certificate for equipment where an Automated Certificate Management Environment (ACME) client cannot be installed or run.
Equipment without shell access, and platforms where policy prevents software being added, are the usual examples.
It also serves as a way to understand how Certificate as a Service (CaaS) works in practice. Working through the four steps by hand shows plainly what an automated client does on your behalf.
Where a client can be run, it remains the better choice, because automation removes the manual work and keeps every file on your own equipment. Learn About Automated Client Options 🔗
Recommended Use
Trustico® recommends this tool for installations within a testing or development environment, or where an SSL Certificate is required for development purposes.
The safest way to produce any private file or credential is to generate it directly on the server where it will be used, so that nothing sensitive is created or held anywhere else. That principle applies whatever tooling you choose.
Assistance and Authorization
Customers already engage Trustico® to assist with the generation and installation of their SSL Certificates. This tool is an extension of that existing assistance rather than a separate service.
Files of this kind are produced on request, and only where Trustico® has been authorized to do so by the customer holding the license. Anyone using the tool is asking Trustico® for help to have an SSL Certificate issued and to be able to put it fully to use.
Validation remains yours to complete either way, because proving control of a domain name is something only the domain holder can do.
You are equally welcome to carry out every step yourself within your own environment, rather than involving Trustico® or any other third party. Learn About Running Automation Yourself 🔗
Requirements Before Starting
You need a current Certificate as a Service (CaaS) license, because the tool issues against your existing entitlement rather than creating a new one.
You also need the External Account Binding (EAB) credentials belonging to that license, which are a Key Identifier and an HMAC Key. These are the same credentials an automated client would use. Learn About External Account Binding (EAB) Credentials 🔗
Finally, you need a way to prove control of each domain name, meaning the ability to publish a Domain Name System (DNS) record or place a file on the website being secured. Learn About Obtaining Your Credentials 🔗
The Four Steps
The tool works through four stages in order, and each one waits for you rather than moving on by itself.
Selecting Your Service
Four services are offered : Trustico® Domain Validation, Trustico® Organization Validation, Sectigo® Domain Validation and Sectigo® Organization Validation.
Your choice must match the Certificate as a Service (CaaS) license you hold, because the credentials you supply in the next step belong to one specific service.
Entering Domain Names and Credentials
One SSL Certificate may carry up to 100 domain names, and wildcard entries are supported alongside ordinary names.
You also choose the key type here. RSA is available at 2048, 3072, 4096 and 8192 bits, and Elliptic Curve Cryptography (ECC) is available at P-256 and P-384. RSA at 2048 bits is the default and remains a sound choice for most installations.
Domain Control Verification
Every domain name on the SSL Certificate offers a Domain Name System (DNS) record or a file served over Hypertext Transfer Protocol (HTTP). You choose whichever you can put in place most easily.
Important : A wildcard entry offers the Domain Name System (DNS) record only. That restriction is set by Certificate Authority (CA) rules rather than by Trustico® and applies wherever a wildcard is issued.
Publish the record or place the file, then ask the tool to check it when you are ready. You review the outcome at your own pace, and nothing runs in the background while you wait. Learn About The Validation Procedure 🔗
Downloading Your Files
Four files are produced : the SSL Certificate itself, the intermediate chain, the full chain, and the matching key file. Take them individually or take all four together as an archive.
The intermediate chain is required alongside the SSL Certificate, because browsers need the complete path in order to establish trust. Learn About Intermediate Certificates 🔗
Working Without Deadlines
Nothing in the tool expires and nothing is queued behind a deadline of ours. Validation proceeds only when you press the button, which matters when a Domain Name System (DNS) change has to pass through someone else.
You may also step away entirely. At any point you can download a configuration file, close the browser, and return later on a different day or a different computer to continue from exactly where you stopped.
That means a request begun on a workstation can be finished from elsewhere without starting again, and an afternoon spent waiting for a record to propagate costs you nothing.
File Generation and Storage
The key file that accompanies your SSL Certificate is generated on the Trustico® server rather than inside your browser. This is stated plainly because it affects how the resulting files should be handled.
Warning : For privacy and security purposes, we strongly recommend using tools provided within your hosting or server environment.
This service may store data in an encrypted state for a period of up to 48 hours to facilitate the issuance and delivery process, and anyone holding your configuration file can retrieve your issued files during that time. Stored data is subsequently destroyed and unrecoverable.
Treat the configuration file as a credential for as long as it remains valid, because it is what allows a session to be resumed and the issued files to be collected.
Where your equipment can produce its own key material, doing so keeps everything sensitive inside your own environment and remains the stronger practice. Learn About Generating Your Own Files 🔗
Transit Protection
Every exchange with the tool travels over Hypertext Transfer Protocol Secure (HTTPS). Outbound requests are restricted to approved Trustico® and Sectigo® endpoints, so the tool will not connect anywhere else.
The connection between the tool and its storage layer is encrypted in the same way, with the issuing authority pinned and any unverified endpoint refused rather than trusted.
Storage Protection
A stored session is never written in readable form. It is encrypted before it reaches storage, and the key used to encrypt it is derived from your own session token rather than from anything Trustico® holds.
This is a deliberate design choice rather than a standard arrangement, and building it took considerable effort. Most services of this kind hold a key of their own, which is precisely what has been avoided here.
In plain terms, the part needed to unlock your session travels with you rather than sitting on our side. The technical detail below is provided for anyone who wants to verify that.
| Measure |
Implementation |
| Cipher |
AES-256-GCM |
| Key Derivation |
HKDF-SHA256 |
| Key Source |
Customer Session Token, 256 Bit |
| Salt |
16 Random Bytes, Fresh per Write |
| Initialization Vector |
12 Random Bytes, NIST SP 800-38D |
| Integrity |
Galois/Counter Mode (GCM) Tag |
Because the salt is generated fresh on every write, two saves of the same session are encrypted under different keys.
Consequences Arising from That Design
Trustico® can decrypt a session only while handling a request that presents your token, and that token is not stored. At rest the data is opaque, so a copy of the storage on its own reveals nothing and no master key exists on our side to be leaked or mismanaged.
Presenting the token is itself the decryption. An incorrect token fails the authentication tag, meaning it can neither read the session nor alter it.
Your configuration file is therefore your own recovery path, and the only one. Where the token is lost and no configuration file has been kept, the session cannot be recovered by Trustico® or by anyone else.
The practical result is that keeping your configuration file safe matters, and that losing it costs you the session rather than exposing it to anyone.
Session Cookie Handling
The token is carried in a cookie marked HttpOnly, Secure and SameSite strict, using the host prefix that browsers refuse to set without Secure. Scripts running on the page cannot read it.
Failing Closed
Where any part of this protection cannot be applied in full, the tool stops rather than continuing with something weaker. Failing closed is the deliberate choice throughout.
Stored data is destroyed after 48 hours. It is not archived and cannot be recovered afterwards, by Trustico® support or by anyone else.
Installing the Issued SSL Certificate
Installation is unchanged from any other SSL Certificate. The files are supplied in standard formats that every common platform accepts.
Because the tool exists for equipment that cannot automate, plan how the replacement will be handled before the current SSL Certificate reaches its validity end date. Learn About Installing an SSL Certificate 🔗
The tool is available to every Certificate as a Service (CaaS) customer and adds nothing to the cost of the license you already hold.
