# What Is External Account Binding (EAB)? Definition and Examples

> External Account Binding (EAB) is an ACME feature that links a new ACME account to an existing customer account at the CA using a key ID and HMAC key.

Source: https://ssl.sh/glossary/eab/
Last updated: 2026-11-10

External Account Binding is defined in section 7.3.4 of [RFC 8555](https://www.rfc-editor.org/rfc/rfc8555). The CA gives you a key identifier (kid) and a MAC key through its website or API. When the [ACME](https://ssl.sh/glossary/acme/) client creates its account, it includes an extra JWS that signs the new account's public key with that MAC key, proving the registration was authorized by a known customer. After registration, the ACME account works normally; EAB is not needed for each order.

## Why it matters
[Let's Encrypt](https://ssl.sh/glossary/let-s-encrypt/) does not require EAB, but many other ACME CAs do, because they need to tie certificates to a billing account, a pre-validated organization or abuse controls. ZeroSSL, Google Trust Services and SSL.com, for example, require EAB credentials before an ACME account can be created. EAB is also how [OV certificates](https://ssl.sh/glossary/ov-certificate/) can be automated: the organization is validated once in the CA's portal, and ACME then handles domain validation and renewals.

## Example
```bash
# Certbot with a CA that requires EAB
certbot register --server https://acme.example.com/directory \
  --eab-kid "<KID>" --eab-hmac-key "<HMAC_KEY>" -m admin@example.com

# acme.sh
acme.sh --register-account --server https://acme.example.com/directory \
  --eab-kid "<KID>" --eab-hmac-key "<HMAC_KEY>"
```

Replace the placeholders with the values from your CA's console and keep them out of shell history and version control.

## Common misconceptions
- **The EAB key replaces the ACME account key.** It is used once to bind the account; the account key still signs every later request.
- **EAB credentials are harmless to share.** Anyone holding them may be able to register ACME accounts tied to your CA account, so treat them as secrets.
- **EAB replaces domain validation.** Each domain still needs DCV unless the CA has already validated it for your account.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [OV 证书](https://ssl.sh/zh/glossary/ov-certificate/): OV 证书是 CA 在验证域名控制权之外，还核实了证书中所写组织真实合法存在的 TLS 证书。