Start the ACME HTTP-01 issuance for a registered domain, by hand (activate_whitelabel does it on its own). ASYNC: the authorization is requested, the challenge stored, status goes challenge, and the platform self-checks, validates and flips the row active in the background; poll get_ssl_certificate until challenge is null (active, or failed with a last_error token: domain_not_pointed means the CNAME is not there yet). Not idempotent: each call requests a fresh authorization. 409 conflict: domain_already_active (renew instead), issuance_already_in_progress (an attempt is in flight, whatever the status), cannot_issue_deleted_certificate, acme_unreachable (the CA could not be asked; the row then carries issuance_unavailable).

Contract:

• MCP tool issue_ssl_certificate, registry package mcp.id/ssl_certificates, mount id.partner.
• Operation action, response envelope action_async.
• Flags: dangerous: the MCP layer gates it behind a preview/commit token, and the effect cannot be undone through this API.