SimpleACMEA certificate workflow should fit the service you run, rather than dictate how you expose it. HTTP-01 and DNS-01 both prove control of a name. They place the proof in different systems, which changes what your automation needs to maintain.
For a straightforward public website, HTTP-01 is often the shortest route. For a private service, a wildcard certificate, or a DNS provider without a suitable API, SimpleACME offers a more convenient DNS-01 workflow: delegate one challenge name with a permanent CNAME and let your existing ACME client update it.
How HTTP-01 works
Your client serves a challenge response below /.well-known/acme-challenge/. The certificate authority retrieves it using the validated hostname. With Let's Encrypt, the initial HTTP challenge uses port 80. Redirects have documented constraints, and multiple frontends need to serve the correct response consistently.
This can be almost invisible when your web server or hosting platform already handles ACME. It becomes another routing responsibility when the real service is an internal dashboard, a mail server, a VPN gateway, or an application behind several proxies. HTTP-01 does not validate wildcard identifiers.
How DNS-01 changes the setup
DNS-01 publishes a TXT value at _acme-challenge for the requested name. The application itself does not need an inbound HTTP challenge endpoint. The authority still needs to resolve the public challenge DNS correctly; private application access does not mean private validation records.
Automating ordinary provider DNS updates usually means maintaining a provider-specific plugin and suitable API credentials. Permission scopes, token rotation and client support vary. Those dependencies are manageable, but they may be unnecessary for a task that only needs a challenge record.
Where SimpleACME makes the difference
SimpleACME hosts the delegated challenge updates. You retain your registrar and normal DNS zone. Add the exact CNAME supplied in your account, configure an existing registration in Traefik, win-acme or a Certbot hook, and keep the renewal job scheduled.
Your client keeps certificate keys and remains responsible for requesting, installing and reloading certificates. SimpleACME records TXT activity; a successful TXT update is not proof that installation finished. An active paid term is required for updates, while a single-domain demo can prepare the DNS setup without sending them.
A practical decision
- Use native HTTP-01 when a public website already renews reliably with little configuration.
- Prefer DNS-01 when you need wildcard validation or want the application to remain private.
- Choose SimpleACME when you want DNS-01 without placing your normal DNS-provider API token on the renewal host.
Start with the hostname, confirm that you can edit its challenge CNAME, and use your client's staging mode before production. Prepare your domain or explore the [service](/).