SimpleACMETraefik DNS-01 without a DNS-provider API token
Keep certificate automation in your reverse proxy. Delegate the challenge with one CNAME and configure the ACME-DNS provider with an existing SimpleACME registration.
Read the integration guide →One endpoint.
Familiar tools.
Public integration guidance for Traefik, win-acme and Certbot. A read-only MCP server can help a compatible assistant prepare configurations without receiving your credentials.
Windows DNS-01 with win-acme and SimpleACME
Validate Windows service names without a public HTTP challenge endpoint. Use existing SimpleACME credentials in a reviewed PowerShell DNS hook.
Read the integration guide →Certbot DNS-01 with a permanent CNAME
Use Linux or Docker authentication hooks to publish the DNS proof through SimpleACME. Keep your certificate keys and deployment under your control.
Read the integration guide →Connect the public MCP
Use this URL in a client that supports remote Streamable HTTP MCP servers. Connection is opt-in. The server supports protocol 2025-11-25 with JSON responses; it provides guidance and templates, not account access or DNS mutations.
https://simpleacme.com/mcpAvailable tools
get_service_info— service facts and boundaries.get_setup_guide— client-specific steps.generate_update_script— Bash or PowerShell starter templates using environment placeholders.build_client_config— example configuration for a public hostname.
Review generated files locally. Do not send passwords, certificate keys or customer account data as MCP arguments. Complete subscriber guides and deployment examples remain in the paid setup library. For a ready-to-copy prompt that asks about your service and uses these tools, open Set up any service with AI help.
The authenticated update API
POST https://simpleacme.com/update accepts JSON with subdomain and txt, authenticated using X-Api-User and X-Api-Key. Use the assigned subdomain and a 43-character ACME DNS authorization value. Updates require current paid access. Wait for public TXT visibility before validation.
{"subdomain":"YOUR_ASSIGNED_SUBDOMAIN","txt":"ACME_DNS_AUTHORIZATION_VALUE"}Registrations are created through the account and payment workflow; anonymous /register is blocked. The API receives a TXT value, not a certificate request, so the activity timeline does not confirm issuance.
Your next certificate. A little less complicated.
Keep your DNS provider and your ACME client.
Prepare your domain before activating paid updates.