TigerTrust speaks ACME v2 (RFC 8555) both as a client — so you can pull certificates from Let’s Encrypt, ZeroSSL, or Google Trust Services — and as a server so your internal CA can hand certificates to any ACME-compatible tool (Caddy, cert-manager, acme.sh, Traefik).
Acme

​
What it is

ACME automates the domain validation and certificate issuance handshake with public CAs. You configure an ACME CA under CA Management, choose a challenge type, and TigerTrust handles the rest at renewal time. For wildcard certificates, DNS-01 is required; HTTP-01 works for everything reachable from the public internet.

​
When to use it

  • Issue and renew Let’s Encrypt certificates for all public-facing services automatically.
  • Issue wildcard certificates (for example, *.api.example.com) using DNS-01 without any server touch.
  • Use your internal CA as a drop-in Let’s Encrypt replacement inside the perimeter for internal tools and service meshes.
  • Enable cert-manager in Kubernetes to request certificates from TigerTrust the same way it requests them from Let’s Encrypt.

​
Challenge types

The CA hits http://<domain>/.well-known/acme-challenge/<token> and expects to read a key authorization. TigerTrust deploys the file via a field agent on the origin host — no port-80 traffic needs to reach TigerTrust directly.

​
Set it up

1

Add an ACME CA

Go to CA Management > Add CA and select ACME. Choose Let’s Encrypt production or staging, enter a contact email, and select a challenge type. For ZeroSSL or BuyPass, enter the provider’s directory URL and External Account Binding credentials if required. TigerTrust registers the ACME account and stores the account key encrypted.
2

Configure the challenge method

For HTTP-01: assign a field agent with access to the origin host’s web root. For DNS-01: go to Integrations > DNS Providers and connect the DNS provider that manages your domain. Select that provider on the CA or per certificate.
3

Issue or renew a certificate

Open Certificates > Issue Certificate, pick the ACME CA, enter the common name and SANs, and click Issue. For renewals, enable auto-renewal on the certificate — the challenge flow runs automatically at renewal time.
4

Verify the challenge completed

The certificate detail panel shows the challenge status. If a challenge times out, the panel shows the failure reason (for example, TXT record not found, token file not accessible).

​
What you’ll see

After issuance, the certificate appears in Certificates with the ACME CA as its issuer and autoRenew: true if you enabled it. Challenge tasks are transient — they appear in Monitoring > Alerts only if they fail.
For DNS-01 with a shared DNS zone, use scoped tokens limited to the _acme-challenge record type. TigerTrust only writes _acme-challenge records and cleans them up after each issuance.

​
PKI Core as an ACME server

Your internal CA exposes an ACME directory that any ACME-compatible tool can point at. Configure cert-manager with a ClusterIssuer pointing at your TigerTrust ACME endpoint, and cert-manager will request certificates from your internal CA exactly as it does from Let’s Encrypt — with full audit and policy enforcement. 
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: tigertrust-internal
spec:
  acme:
    server: https://tigertrust.example.com/acme/directory
    email: [email protected]
    privateKeySecretRef:
      name: tigertrust-acme-account
    solvers:
      - http01:
          ingress:
            class: nginx

Renewal automation

How ACME renewals get scheduled and retried.

DNS providers

Set up Cloudflare, Route 53, or Azure DNS for DNS-01 challenges.

Certificate Authorities

Configure Let’s Encrypt, ZeroSSL, or your own ACME endpoint.