SimpleACMEA private application can use a publicly trusted certificate without making its login page reachable from the internet. The key is to validate control of a public DNS name through DNS-01 rather than asking the application to serve an HTTP challenge.
SimpleACME is designed for this separation. Your public DNS delegates the challenge name with one CNAME. Your ACME client publishes authorization values through SimpleACME, while your firewall continues to protect the application.
Start with a name you control
Use a public DNS name such as admin.example.com, even if your internal resolver maps it to a private address. A public certificate authority cannot issue the same kind of public certificate for an arbitrary private suffix just because your internal DNS knows it.
Certificate issuance and public certificate-transparency records also affect naming privacy. Keeping a service unreachable does not guarantee that its certificate names remain secret. Avoid putting sensitive project names into public certificate identifiers if their disclosure is a concern.
Separate the three network paths
- Users connect to the private application through the network access you allow.
- The ACME client reaches the certificate authority and SimpleACME over the necessary outbound connections.
- The authority queries publicly resolvable challenge DNS.
These paths do not need to terminate on the same machine. You can issue from a controlled renewal host and deploy the result into a private service using that service's supported mechanism.
Set up the DNS proof once
Prepare the name in SimpleACME, select the correct coverage and add the account's challenge CNAME. A paid domain accepts authenticated TXT updates; a demo can prepare its delegation but cannot complete that update step.
After checking the CNAME, configure Traefik, win-acme or Certbot. Use staging and verify DNS from outside the local resolver view. Split-horizon DNS can hide a missing public CNAME when an administrator only checks from inside the network.
Finish the deployment, not just issuance
Import the certificate and key in the form your application expects. Some services use PEM files, others require a PFX or a dedicated certificate store. Check chain requirements, permissions and the reload process.
A renewed file is not enough if the service keeps serving an old certificate from memory. Test the endpoint after deployment and monitor its expiry independently of the DNS-update timeline.
Why SimpleACME is useful here
You avoid an inbound HTTP challenge route and do not need a normal DNS-provider API token on the private service. The same delegated validation pattern can support a VPN name, a NAS interface, a mail hostname or a management dashboard.
If a public web server already handles HTTP-01 reliably, changing it may add little value. For private services, [SimpleACME's one-CNAME workflow](/) offers a cleaner way to keep validation separate from application exposure.