SimpleACMEPrepare your domain
Create an account. Choose single or wildcard coverage, or prepare one single-domain demo.
DNS-01 WITHOUT A DNS-PROVIDER APINo DNS API access?
No DNS API access?
You can still automate.
Add the supplied challenge CNAME manually. Your ACME client sends later TXT updates to SimpleACME, so certificate validation no longer depends on a provider-specific API integration.
Create an account first. One single-domain demo can prepare DNS with updates blocked. ONE-TIME DELEGATION
Your DNS provider
↓ permanent CNAME_acme-challenge.example.comSimpleACME challenge account
YOUR_SUBDOMAIN.simpleacme.com↻ New TXT values. Same CNAME.
Illustrative names. Your account supplies the exact record.01 CNAME per challenge name00 normal DNS-provider API tokens00 inbound HTTP challenge endpoints
Four steps to certificate-ready.
Add one CNAME
Copy the exact challenge record from your account. Keep it in place for later renewals.
Configure your client
Use Traefik, win-acme or Certbot with your existing registration. Paid access enables TXT updates.
Track DNS changes
Review TXT activity in SimpleACME and verify issuance and deployment in your client.
ONE WILDCARD. ROOM TO GROW.Every first-level subdomain.
Every first-level subdomain.
One certificate.
Use *.example.com for names such as app.example.com, mail.example.com and vpn.example.com. DNS-01 supports wildcard validation while the services remain private.
A wildcard matches one label. It does not automatically cover the parent name or deeper names. Choose additional certificate identifiers deliberately and protect shared private keys.
Understand wildcard coverage →*.example.comapp.example.commail.example.comvpn.example.com
DNS-01 flexibility.
Less provider-specific work.
| Requirement | SimpleACME | Own HTTP-01 | Provider DNS-01 API |
|---|---|---|---|
| DNS-provider API token | Not needed | Not needed | Provider token and supported integration |
| Public HTTP challenge endpoint | Not needed | Port 80 challenge reachability | Not needed |
| Wildcard validation | Supported | Not supported | Supported |
| Repeatable setup | One CNAME per challenge owner | Challenge routing on the serving hosts | Provider permissions and client plugin |
| Private applications | Good fit | Requires a public challenge path | Good fit |
| DNS provider changes | Preserve the challenge CNAME | Preserve working HTTP routing | Review the new provider integration |
| Main responsibility | Client issuance + deployment | Client and HTTP routing | Client and DNS API permissions |
| Service dependency | SimpleACME and paid update access | Your HTTP infrastructure | Provider API and credentials |
Native HTTP-01 is often a good fit for a simple public website. A well-scoped provider DNS API is also valid. SimpleACME is particularly useful for private services, wildcard validation, or providers without a suitable API. Read the detailed comparison →
Familiar tools. One DNS workflow.
Traefik
Keep certificate automation in your reverse proxy. Delegate the challenge with one CNAME and configure the ACME-DNS provider with an existing SimpleACME registration.
See the integration →win-acme
Validate Windows service names without a public HTTP challenge endpoint. Use existing SimpleACME credentials in a reviewed PowerShell DNS hook.
See the integration →Certbot
Use Linux or Docker authentication hooks to publish the DNS proof through SimpleACME. Keep your certificate keys and deployment under your control.
See the integration →Complete guides, configuration files and Bash / PowerShell examples are available to active subscribers. Your client retains certificate keys; SimpleACME records TXT activity.
One hostname. Or room to grow.
Single domain
For the service name you want to secure.
USD 34.99 / year
Prepare this domain →Recurring yearly subscription. Final tax is shown at checkout.Wildcard domain
For first-level subdomains under your chosen parent.
USD 89.99 / year
Prepare this domain →Recurring yearly subscription. Final tax is shown at checkout.Create an account to look around. One single-domain demo can prepare DNS with updates blocked. Paid registrations are created after accepted payment; your ACME client issues and installs the certificate.
A little clarity before you start.
Can I automate certificates without a DNS-provider API?
Yes. Add the challenge CNAME supplied by SimpleACME once, then configure an existing SimpleACME registration in your ACME client. Later TXT updates go to SimpleACME rather than your normal DNS provider. You still need permission to edit that CNAME.
Can my application stay private without opening port 80?
Yes. DNS-01 validates a publicly resolvable challenge record instead of an inbound HTTP challenge endpoint. The issuing client still needs the relevant outbound connectivity. Use a public DNS name you control, even if the application is reached on a private network.
Can SimpleACME help with wildcard certificates?
Yes. DNS-01 supports wildcard validation. A certificate for *.example.com can match first-level names such as app.example.com and vpn.example.com. It does not automatically cover example.com or app.team.example.com. Request any additional certificate names deliberately.
Do I need to move my DNS, website or email?
No. Your normal DNS zone, website and email records remain with your provider. Only the challenge name is delegated using its CNAME. SimpleACME does not become a reverse proxy for your application.
Your next certificate. A little less complicated.
Keep your DNS provider and your ACME client.
Prepare your domain before activating paid updates.