Supported certificate authorities
NextPKI is a control plane over the CAs you already use. The registry below is what the platform models; whether a given CA is usable for your tenant also depends on a connector being configured and, for commercial CAs, on a reseller relationship being in place.
Capability flags come from the provider registry itself.
| Provider | Country | API | ACME | EAB | Inventory sync | S/MIME | Code signing | QWAC |
|---|---|---|---|---|---|---|---|---|
| DigiCert | US | REST | ✓ | ✓ | ✓ | ✓ | ✓ | |
| Sectigo | GB | REST | ✓ | ✓ | ✓ | ✓ | ✓ | |
| GlobalSign | BE | REST | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Entrust | US | REST | ✓ | ✓ | ✓ | ✓ | ||
| D-Trust | DE | REST | ✓ | ✓ | ✓ | ✓ | ||
| SwissSign | CH | REST | ✓ | ✓ | ✓ | ✓ | ||
| Actalis | IT | REST | ✓ | ✓ | ✓ | |||
| Let’s Encrypt | US | ACME | ✓ | |||||
| ZeroSSL | AT | ACME | ✓ | ✓ | ✓ | |||
| Buypass | NO | ACME | ✓ | ✓ | ✓ | |||
| GoGetSSL | LV | REST | ✓ | ✓ | ||||
| The SSL Store | US | REST | ✓ | ✓ | ✓ | |||
| PSW Group | DE | REST | ✓ | ✓ | ||||
| SSLplus | DE | REST | ✓ | |||||
| NextPKI Private CA | - | custom | ✓ | ✓ | ✓ | ✓ | ✓ |
Reading the flags
Section titled “Reading the flags”ACME means the CA speaks RFC 8555, so renewal can be fully automated with domain validation handled by the protocol. EAB (External Account Binding) ties an ACME account to your commercial account at that CA - required by every commercial ACME endpoint, and the reason you cannot simply point certbot at them.
Inventory sync means the CA exposes a listing API, so NextPKI can import what you already manage there as a discovery source. Let’s Encrypt does not: ACME has no listing endpoint, so LE-issued certificates are discovered through Certificate Transparency and your sensors instead.
QWAC matters for EU work - those CAs are ETSI-qualified trust service providers and can issue qualified website authentication certificates for eIDAS purposes.
What is actually implemented today
Section titled “What is actually implemented today”The registry describes the target. Implementation status is narrower:
| Status | Providers |
|---|---|
| Working | Let’s Encrypt, via a purpose-built RFC 8555 client |
| Registry entry, plugin pending | Everything else |
Commercial CAs are gated on reseller agreements, not on engineering. If you need a specific CA, telling us moves it up the list - a customer with a live account is what unblocks a partner conversation.
Multiple providers, one plugin
Section titled “Multiple providers, one plugin”Providers sharing a plugin_code share an implementation. sectigo_reseller_api
already backs The SSL Store, PSW Group and SSLplus; acme_generic backs Let’s
Encrypt, ZeroSSL and Buypass.
The practical consequence for you: adding a reseller that runs on an already-integrated platform is a configuration change, not a release. See CA connectors.
The private CA
Section titled “The private CA”NextPKI Private CA is not an external authority. It is the built-in private PKI
for internal trust - mTLS between services, device identity, anything that must
not touch a public CA. See private PKI.