ACME.Account reference

Account

Source: src/ACME/Account.ts

An ACME account with a certificate authority — the identity that every Certificate and every runtime IssueCertificate call signs with. One per CA per stack.

The account key is generated on first reconcile and persisted as a redacted value alongside the CA’s account URL. Protect the state store as secret material; redaction alone does not encrypt the storage backend.

Account: Let’s Encrypt

export const LetsEncrypt = ACME.Account("LetsEncrypt", {
  ca: ACME.LetsEncrypt,
  contact: ["mailto:ops@example.com"],
  termsOfServiceAgreed: true,
});

Account: External Account Binding

ZeroSSL and Google Trust Services bind ACME accounts to an existing customer account with a key id + HMAC pair from their dashboard (ZeroSSL also mints them over its REST API — see @distilled.cloud/zerossl).

export const ZeroSsl = ACME.Account("ZeroSSL", {
  ca: ACME.ZeroSSL,
  eab: {
    keyId: Config.String("ZEROSSL_EAB_KID"),
    hmacKey: Config.Redacted("ZEROSSL_EAB_HMAC_KEY"),
  },
  termsOfServiceAgreed: true,
});

Account: Private CAs

A private CA (Pebble, step-ca) whose HTTPS certificate is not publicly trusted passes its root as trustedRoot.

export const Pebble = ACME.Account("Pebble", {
  ca: { directoryUrl: "https://localhost:14000/dir", trustedRoot: pebbleRootPem },
  termsOfServiceAgreed: true,
});