FairSSL ACME and the portal
dns-persist: one DNS record, and every name is approved in advance
Works today with every ACME client, including certbot, which does not support dns-persist-01 yet. You do not have to wait for the standard or for your client.
You create one TXT record on your domain, once. From then on the domain and every name under it are approved in advance, and DigiCert certificates are issued immediately, both in the FairSSL portal and through FairSSL ACME.
What dns-persist is
dns-persist is a CA/Browser Forum validation method, section 3.2.2.4.22 of the Baseline Requirements. Instead of a new token for every order, one permanent TXT record approves your certificate account for the domain. DigiCert reads the record when an order is placed, so there is nothing to create per order and nothing at renewal.
The validation happens between FairSSL and DigiCert, over DigiCert's API. Your ACME client gets no validation task: by the time it orders, the domain is already approved. That is why it works with every ACME client: certbot, win-acme, cert-manager, acme.sh and appliances, with no DNS plugin and without the client supporting dns-persist-01.
The IETF draft for dns-persist-01 in ACME is at version -02, dated 20-09-2026. It changes nothing for you, because the validation here does not run as an ACME challenge.
The record
You create the record on your own domain:
_validation-persist.yourdomain.com. IN TXT "digicert.com; accounturi=<your account URI>; policy=wildcard"- Your own value is shown in the portal. We do not create the record for you, because it is your proof that you control the domain.
policy=wildcardmeans the record also covers subdomains and wildcard certificates.- The record must stay in place. If it is deleted, orders fall back to validation per order with
_dnsauthand AutoDNS.
Which certificates
dns-persist covers the DigiCert certificates at FairSSL: RapidSSL, GeoTrust, Thawte and DigiCert, as DV, OV and EV.
Requires your own DigiCert account
The record approves an entire certificate account, so dns-persist requires your own DigiCert account at FairSSL. Contact us to have it activated.
On FairSSL's shared DigiCert account you use AutoDNS, which validates every order automatically. That also applies to OV and EV with your own organization.
dns-persist-01 at other CAs
At the other CAs dns-persist-01 is an ACME challenge, so both the CA and your ACME client must support it.
| CA | Status |
|---|---|
| Google Trust Services | ✓ Yes ↗ |
| Let's Encrypt | Not yet, planned (waiting for the next version of the standard) |
| GlobalSign | Planned for 2027 |
| ZeroSSL | ✗ Not supported |
| Sectigo ACME | ✗ Not supported |
Certificates on many servers and appliances
A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.
dns-persist-01 in sslbrain: no DNS keys on your servers(opens sslbrain.com in a new tab)Ready to create a free account?
Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.