SimpleACMECertbot DNS-01 with a permanent CNAME
Use Linux or Docker authentication hooks to publish the DNS proof through SimpleACME. Keep your certificate keys and deployment under your control.
Prepare your domain →Your setup sequence
- Prepare an active SimpleACME domain and its verified challenge CNAME.
- Store the existing registration securely and map each intended hostname to the right registration.
- Use a manual authentication hook that reads CERTBOT_VALIDATION, posts the assigned subdomain and TXT value to /update, checks HTTP errors and waits for propagation.
- Run certbot certonly --staging --manual --preferred-challenges dns with your reviewed authentication and cleanup hooks, using a separate test certificate name.
- Create the production renewal without --staging, retain one renewal scheduler and configure a deployment hook. With Docker, persist the whole certificate directory through bind mounts.
Keep the scope clear
SimpleACME serves delegated TXT updates. Your client requests and renews the certificate, protects its key and deploys it. Use a CNAME per configured challenge owner; keep the existing registration and storage persistent. A demo cannot update DNS.
Configuration and script examples
Open the full subscriber guide →
Public starter templates are also available through the read-only MCP. They contain placeholders, not credentials, and must be reviewed for your environment.
Official client references
Your next certificate. A little less complicated.
Keep your DNS provider and your ACME client.
Prepare your domain before activating paid updates.