SimpleACMETraefik DNS-01 without a DNS-provider API token
Keep certificate automation in your reverse proxy. Delegate the challenge with one CNAME and configure the ACME-DNS provider with an existing SimpleACME registration.
Prepare your domain →Your setup sequence
- Create and activate the intended domain in your SimpleACME account. Add and verify its exact challenge CNAME.
- Populate the ACME-DNS account storage with the existing registration from your account. Anonymous /register is not available.
- Set ACME_DNS_API_BASE=https://simpleacme.com and ACME_DNS_STORAGE_PATH to the persistent account file inside Traefik. Use provider: acme-dns in your resolver.
- Protect the registration and ACME certificate storage. Use staging first, attach the resolver to the intended router, then request production certificates.
- Monitor client renewal and the served certificate. The SimpleACME timeline covers TXT changes, not installation.
Keep the scope clear
SimpleACME serves delegated TXT updates. Your client requests and renews the certificate, protects its key and deploys it. Use a CNAME per configured challenge owner; keep the existing registration and storage persistent. A demo cannot update DNS.
Configuration and script examples
Open the full subscriber guide →
Public starter templates are also available through the read-only MCP. They contain placeholders, not credentials, and must be reviewed for your environment.
Official client references
Your next certificate. A little less complicated.
Keep your DNS provider and your ACME client.
Prepare your domain before activating paid updates.