Choose the managed target
Website SSL operates only on the target's owned primary name, aliases and subdomains. Installation-owned Panel/mail targets require their separately authorized target flow; Customer DNS authority is never borrowed for an installation certificate. Read the advertised certificate directories and challenge capabilities before filling the form.
ACME setup and preflight
Select names, the supported ACME directory, contact email and explicit subscriber-terms acceptance. HTTP-01 needs public DNS and inbound TCP 80 for every non-wildcard name. DNS-01 requires an authorized local zone belonging to the same account and is required for wildcards. External DNS changes are not silently automated.
The request fields are account_id, target_kind, target_id, hostnames, source: acme, directory_id, challenge, dns_zone_id, contact_email and terms_accepted. Run POST /v1/certificate-preflight and review DNS, IPv6, routing, firewall and reported problems. Only an eligible current result advances to review; the CA still performs its own challenge.
The directory choices can include local test ACME, Let's Encrypt staging and production when actually advertised. Production is locked until that exact target and hostname set succeeds against staging in the allowed evidence window. Do not treat a staging certificate as public trust. The flow leaves HSTS off to avoid locking browsers to an unproven HTTPS target.
Import an existing certificate
Supply the leaf/intermediate PEM chain and matching unencrypted PKCS#8 or supported PEM private key through the protected form. The agent checks chain, names, expiry and key match before staging. Keys are sent once through the protected local channel, not job history/PostgreSQL; the browser clears them on completion. Never paste a key into a support ticket. Import replacement uses the existing certificate and revision rather than creating competing unmanaged activation.
Renew, replace and revoke
Inspect not_after and next_renewal_at. The manual renewal control is available for ACME when due; imported certificates need replacement through their actual issuer process. Renewal is scheduled before expiry with bounded retry/backoff, but delivery/routing/outage acceptance still needs real tests. Revoke uses the current revision and reason 0 in this interface. ACME revocation contacts its authority and cannot be undone; removing an imported certificate only withdraws managed TLS activation, not issuer-side revocation.
Verify the result
Wait for the durable certificate job, then independently inspect served chain, exact names, expiry and IPv4/IPv6 behavior. Local service success is not public TLS acceptance. If DNS, listener or capability fails, correct the reviewed prerequisite and retain the operation; never suppress CA/TLS checks. Customer HTTPS Redirect is not a separate implemented menu action in this checkpoint.