Multi-CA SSL Failover with acme.sh: ZeroSSL, Buypass & Google Trust Services

Relying on a single Certificate Authority for your SSL certificates is a single point of failure. If your CA experiences an outage, changes its issuance policy, or rate-limits your domain, your renewals will fail silently — until your site starts showing security warnings. This guide shows you how to configure a multi-CA SSL setup using acme.sh with ZeroSSL, Buypass Go SSL, and Google Trust Services as fallback providers alongside Let's Encrypt.

Why You Need a Multi-CA Strategy

Let's Encrypt issues over 3 million certificates per day and is the default CA for most automated SSL tools. That popularity also makes it a dependency risk. In 2026, several operators discovered their domains were excluded from Let's Encrypt issuance due to geographic or policy restrictions — and had no fallback in place.

A multi-CA setup means: if CA #1 fails to issue or renew, your automation script tries CA #2, then CA #3. Your certificate never expires because of one provider's problem.

The Four Free CAs Worth Knowing

Let's Encrypt

The most widely used free CA. 90-day validity, supports wildcard certificates via DNS-01 challenge, rate limit of 50 certificates per registered domain per week. ACME endpoint: https://acme-v02.api.letsencrypt.org/directory

ZeroSSL

Backed by apilayer. Free tier supports 3 active certificates via API (unlimited via ACME). 90-day validity, supports wildcard, has a web dashboard for manual management. ACME endpoint: https://acme.zerossl.com/v2/DV90Requires EAB credentials — generate them free at app.zerossl.com.

Buypass Go SSL

Norwegian CA. Free certificates with 180-day validity (longer renewal window than Let's Encrypt). Supports HTTP-01 and DNS-01 challenges. No wildcard on free tier. ACME endpoint: https://api.buypass.com/acme/directory

Google Trust Services

Free via Google Cloud. Requires a Google account and EAB credentials from Google Cloud Console. 90-day validity, supports wildcard. ACME endpoint: https://dv.acme-v02.api.pki.goog/directory

Setting Up acme.sh with Multiple CAs

Install acme.sh

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc

Register ZeroSSL EAB Credentials

ZeroSSL requires External Account Binding. Get your EAB key and HMAC from the ZeroSSL dashboard under Developer > ACME Credentials, then register:

acme.sh --register-account \
  --server zerossl \
  --eab-kid YOUR_EAB_KID \
  --eab-hmac-key YOUR_EAB_HMAC

Register Google Trust Services EAB

In Google Cloud Console, go to Certificate Manager > ACME External Account Keysand create a new key:

acme.sh --register-account \
  --server google \
  --eab-kid YOUR_GTS_KID \
  --eab-hmac-key YOUR_GTS_HMAC

Issue a Certificate (with Fallback Logic)

Create a shell script that tries each CA in order and stops on the first success:

#!/bin/bash
DOMAIN="example.com"
WEBROOT="/var/www/html"

CAs=("letsencrypt" "zerossl" "buypass" "google")

for CA in "${CAs[@]}"; do
  echo "Trying CA: $CA"
  acme.sh --issue \
    --server $CA \
    -d $DOMAIN \
    -d www.$DOMAIN \
    --webroot $WEBROOT \
    --force

  if [ $? -eq 0 ]; then
    echo "Success with $CA"
    break
  else
    echo "$CA failed, trying next..."
  fi
done

Install the Certificate to Nginx

acme.sh --install-cert -d example.com \
  --cert-file /etc/nginx/ssl/example.com.crt \
  --key-file /etc/nginx/ssl/example.com.key \
  --fullchain-file /etc/nginx/ssl/example.com-fullchain.crt \
  --reloadcmd "systemctl reload nginx"

Nginx SSL Configuration

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/nginx/ssl/example.com-fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

Automating Renewals with Cron

acme.sh adds a cron job automatically during installation, but verify it exists:

crontab -l | grep acme

You should see something like:

0 0 * * * /root/.acme.sh/acme.sh --cron --home /root/.acme.sh

This runs daily. acme.sh will only attempt renewal when the certificate is within 30 days of expiry. If you want to use the fallback script for renewals, replace the default cron command with your multi-CA script path.

Monitoring Certificate Expiry

Add a simple expiry check to your monitoring:

# Check days until expiry
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -enddate

For automated alerting, tools like Uptime Kuma include certificate expiry monitoring out of the box and can notify you via Telegram, Slack, or email.

Conclusion

A multi-CA SSL strategy takes about 30 minutes to set up and eliminates one of the most avoidable causes of certificate expiry incidents. Start with Let's Encrypt as your primary, add ZeroSSL or Buypass as fallback, and let acme.sh handle the rest automatically. For cPanel shared hosting, check out the guide on installing SSL on cPanel and the comparison of free SSL certificate alternatives.