Traefik DNS-01 with SimpleACME: prepare the account before renewal

Traefik can manage ACME certificates as part of a reverse-proxy deployment. DNS-01 is particularly useful when you need wildcard coverage or do not want certificate validation to depend on a public HTTP challenge route. SimpleACME gives Traefik a stable challenge-update service without a token for your normal DNS provider.

The important preparation is the registration. SimpleACME registration is managed by the account and paid-domain workflow. Configure Traefik with that existing registration rather than expecting anonymous registration to succeed.

Prepare the DNS and account file

Create the domain in SimpleACME, activate its paid term, and add its exact challenge CNAME. Verify the name before starting repeated issuance attempts. Then populate the ACME-DNS account file with the username, password, assigned subdomain and full target provided in the account.

Traefik's provider uses the ACME_DNS_API_BASE and ACME_DNS_STORAGE_PATH configuration. The API base is https://simpleacme.com. The storage path is a file inside the container, backed by a persistent host folder so recreating the container does not discard the registration.

Configure a resolver deliberately

A representative resolver uses the ACME-DNS provider name below. Review it against the documentation for your installed Traefik release.

certificatesResolvers:
  simpleacme:
    acme:
      email: admin@example.com
      storage: /certificates/acme.json
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      dnsChallenge:
        provider: acme-dns

This is an excerpt, not a complete production proxy. Define the intended entrypoints, attach the resolver to the relevant router and set the correct certificate names. Protect both ACME storage and the ACME-DNS account file; they hold different credentials and neither belongs in a public repository.

Check persistence and permissions

• Keep the certificate storage and account-registration storage across container recreation.
• Make the account file accessible only to the Traefik process and administrators.
• Confirm outbound HTTPS and DNS resolution from the container network.
• Use staging first, then remove the staging CA setting for trusted production issuance.

Some provider versions persist account information, so confirm the required write permissions for your installed version. Do not resolve a permissions error by making credentials readable by every local user.

A simpler provider-independent setup

Once the delegation and existing account are correct, later renewals reuse them. If your normal DNS provider changes, the client integration can remain the same as long as the new zone preserves the CNAME. That is SimpleACME's advantage over repeatedly adapting a provider-specific plugin.

The public integration guide explains the architecture; the subscriber library contains complete adaptable files. Monitor Traefik's issuance logs and the certificate served by the proxy, alongside the TXT timeline in SimpleACME.