Certificate questions.
Simpler answers.

Yes. Add the challenge CNAME supplied by SimpleACME once, then configure an existing SimpleACME registration in your ACME client. Later TXT updates go to SimpleACME rather than your normal DNS provider. You still need permission to edit that CNAME.

Yes. DNS-01 validates a publicly resolvable challenge record instead of an inbound HTTP challenge endpoint. The issuing client still needs the relevant outbound connectivity. Use a public DNS name you control, even if the application is reached on a private network.

Yes. DNS-01 supports wildcard validation. A certificate for *.example.com can match first-level names such as app.example.com and vpn.example.com. It does not automatically cover example.com or app.team.example.com. Request any additional certificate names deliberately.

No. Your normal DNS zone, website and email records remain with your provider. Only the challenge name is delegated using its CNAME. SimpleACME does not become a reverse proxy for your application.

Yes, while you keep the same registration and delegation. The CNAME remains in place; the TXT authorization value behind it changes. You need one CNAME per distinct configured challenge owner name, rather than one for an entire unrelated collection of names.

The documented workflows cover Traefik with its ACME-DNS provider, win-acme with a PowerShell DNS hook, and Certbot with authentication hooks, including Docker. Configure the existing registration from your account. Client versions and application deployment requirements still need review.

No. Your ACME client requests and renews certificates with the certificate authority and handles private keys. SimpleACME manages delegated TXT challenge updates. Installation, application bindings and reloads remain part of your deployment workflow.

You can create an account and prepare one single-domain demo, including its challenge CNAME. The demo cannot send /update requests. Paid single-domain and wildcard registrations are created after accepted subscription payment.

Paid DNS-update access remains available until its original paid-through date even if provider renewal is paused or canceled. Pausing or resuming does not extend that date. Approved refunds, including partial refunds, and chargebacks immediately block updates. Already-issued certificates remain valid until their own expiry.

The timeline records TXT authorization changes, not confirmed certificate issuance or installation. Compare those events with your ACME client logs and the certificate actually served. Optional DNS-change email notifications are available in account settings.

Yes. POST JSON containing the assigned subdomain and 43-character TXT authorization value to https://simpleacme.com/update with X-Api-User and X-Api-Key headers. Use the existing account credentials, keep secrets private, handle HTTP errors and wait for DNS visibility before continuing validation.

Yes, if its client supports connecting to a remote MCP server. The public SimpleACME MCP at /mcp supplies service information, integration guidance and starter script templates. It does not receive your private key, create registrations, execute scripts or perform DNS updates. Connection is opt-in and support varies by AI client.