Certbot DNS-01 hooks without a DNS-provider API token

Certbot can automate DNS-01 through authentication hooks. The hook receives the challenge information, publishes the TXT value and returns successfully only when validation can proceed. SimpleACME provides the authenticated update endpoint, so the hook does not need access to your full DNS zone.

This is different from copying a manual TXT value into a DNS panel for each renewal. Once the CNAME is in place, the same hook can handle later challenges while the client maintains its ACME account, certificates and renewal configuration.

Prepare before writing the hook

Create the appropriate SimpleACME domain, activate paid access and verify the permanent CNAME. Store the account credentials on the renewal host using a restricted file or the host's secret-management mechanism. Never put an API password in a blog comment, shell history or a public issue.

Certbot exposes CERTBOT_VALIDATION to an authentication hook. That is the TXT authorization value to send. It is not the raw HTTP-01 challenge token and should not be reconstructed from unrelated environment variables.

The hook's responsibilities

1. Map the requested hostname to the intended existing SimpleACME registration.
2. Validate that the TXT value and required credentials are present.
3. POST the assigned subdomain and TXT value to https://simpleacme.com/update with the required authentication headers.
4. Stop on an authentication, subscription or transport error.
5. Wait until the required value is visible in DNS before returning success.

Avoid a hook that reports success after a failed HTTP request. That turns an actionable update error into a confusing certificate-authority validation failure.

Connect the hooks to Certbot

This example assumes reviewed hook files have already been installed at the shown paths.

sudo certbot certonly --staging --manual --preferred-challenges dns \
  --manual-auth-hook /opt/simpleacme/simpleacme-auth.sh \
  --manual-cleanup-hook /opt/simpleacme/simpleacme-cleanup.sh \
  --cert-name simpleacme-test -d app.example.com

Use a separate staging certificate name. Once validation and deployment work, create the intended production renewal without --staging. Run certbot renew --dry-run and retain a reliable scheduler, rather than assuming that saving a certificate once guarantees future renewal.

Keep deployment separate

Renewing a file does not make an application use it. Configure a deployment hook or another controlled workflow to reload the consuming service after a successful renewal. Check the certificate actually served by that application and keep rollback material until the deployment is verified.

SimpleACME simplifies the DNS portion: one challenge delegation, one update API and no provider-specific zone token. The Certbot integration overview and subscriber guide explain the full workflow. Public examples are starter guidance; choose exact paths, permissions and service-reload commands for your environment.