Strata Copilot
    Next-Gen Trust Security
    : Configure ACMEv2 Server Connection in Next-Gen Trust Security
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Welcome to Configuration
    6. ACME Server Overview
    7. Configure ACMEv2 Server Connection in Next-Gen Trust Security

    Next-Gen Trust Security

    Configure ACMEv2 Server Connection in Next-Gen Trust Security

    Table of Contents

    Configure ACMEv2 Server Connection in Next-Gen Trust Security

    Use this procedure to create an ACMEv2 server in Next-Gen Trust Security.
    Use Next-Gen Trust Security to create an ACMEv2 server that allows ACME-compatible clients to request certificates by using the ACME protocol.

    Before You Begin

    You need the following before you create an ACMEv2 server:
    • A Next-Gen Trust Security account with Integration Administrator permissions.
    • At least one configured Issuing Template.
    Note: Certificates issued through ACMEv2 servers require user-generated CSRs.
    • Optional. A Certificate Tag, if your organization uses tags to categorize certificates.
    Important: All ACMEv2 servers use External Account Binding (EAB) for client registration.ACME clients must provide valid EAB credentials, including a Key ID and HMAC key, when creating an account.

    Overview

    Next-Gen Trust Security supports the Automatic Certificate Management Environment (ACME) protocol as defined in RFC 8555. The ACME protocol enables automated certificate enrollment.
    With an ACMEv2 server, you can:
    • Create an ACME endpoint for your organization.
    • Allow ACME clients that are compatible with EAB to request certificates from Next-Gen Trust Security.
    • Issue certificates based on issuing templates so that certificate requests follow defined policies.
    For information about how certificate requests are evaluated, issued, and managed when using an ACMEv2 server, see ACME server overview.

    Step 1: Create an ACMEv2 Server

    1. Sign in to Next-Gen Trust Security.
    2. Click Configuration > ACME Servers.
    3. Select New.
    4. Enter a Name for the ACMEv2 server.
    5. Select an Issuing Template. For more information, see Creating issuing templates.
    Note: Issuing templates that do not allow CSRs do not appear in the Issuing Template list.
    1. Optional. Select a Certificate Tag.
    2. Select Create.

    Step 2: Configure the ACMEv2 Client Connection

    After you create the ACMEv2 server, configure your ACME client by using the connection details provided in Next-Gen Trust Security.
    Each ACME client has its own configuration process. All clients require the same core values.
    1. Copy the following values from Next-Gen Trust Security:
      • ACME Directory URL. The endpoint the client uses to discover supported ACME operations.
      • EAB Key ID (KID). Identifies the External Account Binding key.
      • EAB HMAC Key. A shared secret that authenticates account registration.
    2. Provide these values to your ACME client by following the client documentation.
    3. In Next-Gen Trust Security, select Done.

    Optional: Deactivate an ACMEv2 Server

    You can deactivate an ACMEv2 server when it is no longer required.
    Warning: Deactivating an ACMEv2 server permanently deactivates all associated ACME accounts.
    1. Sign in to Next-Gen Trust Security.
    2. Click Configuration > ACME Servers.
    3. Select the ACMEv2 server that you want to deactivate.
    4. Select Deactivate.

    ACME Protocol Limitations

    The Next-Gen Trust Security ACMEv2 server does not support the following ACME protocol features:
    • Automated certificate renewal
    • Certificate revocation using POST /revoke-cert
    • Key rollover using POST /key-change
    • Authorization challenges such as HTTP-01, DNS-01, and TLS-ALPN-01

    © 2026 Palo Alto Networks, Inc. All rights reserved.