ZeroSSL
zerossl.com/documentation/acme/Certificate authoritydomains-dns/zerosslJSONcomparereport an errorprovider JSON
- Free allowance
- Unlimited 90-day certificates over ACME at no charge, with multi-domain and wildcard certificates; the Free plan's own dashboard allowance is 3 90-day certificates
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented12 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | unlimited 90-day certificates over ACME at no charge, with multi-domain and wildcard certificates; the Free plan's own dashboard allowance is 3 90-day certificates unit unlimited; metered on none |
|---|
| Price | none stated |
|---|
| Limits | - request-rate no ACME rate limit is published: the ACME feature page says 'No Rate Limits' while the documentation says abusive use can be limited or blocked; no number is given source
- request-rate EAB credential creation is limited to a maximum per user per day (the number is unpublished); the credentials are reusable, so one set normally suffices source
- per-object-cap at most 6 labels below the public suffix per name, counting a wildcard asterisk source
|
|---|
| Binding | none no published number binds ACME issuance; the unpublished per-user daily cap on EAB credential creation does not bind a normal client because the credentials are reusable |
|---|
| Identity | email an account made with an email address and a password; no card is needed for the Free plan; the ACME client then needs EAB credentials from that account (https://app.zerossl.com/signup/free, https://zerossl.com/pricing/) |
|---|
| Egress | no charge |
|---|
| Per-object cap | a certificate name may have at most six labels below the public suffix, the wildcard asterisk included; a deeper name needs the ZeroSSL REST API instead of ACME |
|---|
| Retention | ACME certificates are valid 90 days (the directory is named DV90) and must be renewed (90 days) |
|---|
| Interface | rest ACME v2 at https://acme.zerossl.com/v2/DV90 with external account binding required (EAB key id and HMAC key made in the dashboard or by GET api.zerossl.com/acme/eab-credentials?access_key=...); a separate ZeroSSL REST API with an access key also exists |
|---|
| Tooling | acme.sh (owned by ZeroSSL), Caddy and CertMagic, dehydrated, win-acme, getssl, acme-companion, any ACME client that supports EAB |
|---|
| Composes with | a second free ACME CA beside Let's Encrypt: the same 90-day certificates with wildcard names and no published per-domain weekly cap, signed by a different CA, so an ACME client can fail over between the two |
|---|
| Reliability | unverified: no outage history or abuse-block rate was read |
|---|
| Notes | ZeroSSL sells paid plans with more annual certificates, which the ACME allowance does not need. The free dashboard allowance of 3 certificates and the unlimited ACME allowance are different channels, both stated by ZeroSSL. |
|---|
| Evidence note | documented the ACME documentation, the ACME feature page, the pricing FAQ, the sign-up page and the EAB error table were captured and quoted; the live ACME directory answered 200 with externalAccountRequired true. Whether a wildcard name needs the DNS-01 challenge is unverified: the ZeroSSL pages read do not say. |
|---|
| Parsed numbers | |
|---|
Evidence 12