---
title: "ezgh private-ca acme-binding create"
description: "Create an ACME binding; its HMAC key is shown once."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ezgh private-ca acme-binding create

{/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */}

```sh
ezgh private-ca acme-binding create <ca> --name <name> [--profile p] [--max-validity-days n] [--allowed-name name…] [flags]
```

Create an ACME binding for a subordinate CA, owned by you (it orders with your access, and needs certificates.acmeBindings.create and certificates.certificateAuthorities.issue). `--profile` is tlsServer (default), tlsClient or tlsServerClient; `--max-validity-days` (default 30) is at most the CA's longest certificate; `--allowed-name` (repeat) limits it to exact names or a leading \*. label.

The directory URL, key ID and HMAC key are printed; the HMAC key is shown this once.

Part of [`ezgh private-ca acme-binding`](/cli/reference/private-ca-acme-binding).

## Examples

```sh
ezgh private-ca acme-binding create corp-issuing --name cert-manager --allowed-name '*.svc.corp.example'
```

## Flags

| Flag | Type | Default | Description |
| --- | --- | --- | --- |
| `--allowed-name` | string, repeatable |  | a name it may order, exact or \*.domain (repeat; default: any the CA allows) |
| `--max-validity-days` | int | `30` | the longest certificate it orders, at most the CA's |
| `--name` | string |  | what uses it (required) |
| `--profile` | string | `tlsServer` | tlsServer, tlsClient or tlsServerClient |

This command also takes the [global flags](/cli/reference#global-flags).

Source: https://docs.ezghcloud.com/cli/reference/private-ca-acme-binding-create/index.mdx