# SimpleACME

> Delegated DNS-01 challenge automation with one permanent CNAME per challenge owner. No normal DNS-provider API token or inbound HTTP challenge endpoint.

## Product facts
SimpleACME manages TXT challenge updates, not certificate issuance, private keys or installation. The customer's ACME client performs those tasks. Paid yearly access is required for /update. One single-domain demo can prepare DNS but cannot update it. Provider pause/cancel does not shorten the paid term; approved refunds and chargebacks disable updates. TXT activity is not proof of a completed certificate renewal.

## Documentation
- [DNS provider directory](https://simpleacme.com/dns-providers)
- [Self-updating sitemap](https://simpleacme.com/sitemap.xml)
- [Published article RSS](https://simpleacme.com/blog/feed.xml)
- [Service](https://simpleacme.com/)
- [FAQ](https://simpleacme.com/faq)
- [Client integration and MCP](https://simpleacme.com/developers)
- [Traefik](https://simpleacme.com/integrations/traefik)
- [win-acme](https://simpleacme.com/integrations/win-acme)
- [Certbot](https://simpleacme.com/integrations/certbot)
- [OpenAPI](https://simpleacme.com/openapi.json)

## MCP
Endpoint: https://simpleacme.com/mcp
Transport: Streamable HTTP, JSON responses, protocol 2025-11-25. Public read-only setup guidance and placeholder configuration generation. No credentials, registration or DNS mutation tools. Connect explicitly from a compatible client; availability does not imply automatic discovery by all AI systems.

## Public articles
- [One permanent CNAME for repeated certificate renewals](https://simpleacme.com/blog/permanent-cname-certificate-renewals): Understand how a fixed ACME challenge CNAME points to changing TXT authorization values, and how to preserve it across renewals and DNS migrations.
- [Wildcard certificates with one permanent challenge CNAME](https://simpleacme.com/blog/wildcard-certificates-one-cname): Secure first-level subdomains using wildcard DNS-01 validation. Understand wildcard coverage, the apex name and permanent CNAME delegation with SimpleACME.
- [Troubleshoot DNS-01 certificate failures in the right order](https://simpleacme.com/blog/troubleshoot-acme-dns01): Diagnose CNAME, authentication, DNS propagation, client and deployment failures separately. Use SimpleACME's TXT timeline as one part of the evidence.
- [Certificates for private services without opening port 80](https://simpleacme.com/blog/private-services-without-port-80): Use public DNS validation for private dashboards, VPNs and management interfaces. SimpleACME removes the need for a public HTTP challenge endpoint.
- [Let's Encrypt without a DNS-provider API: one CNAME is enough](https://simpleacme.com/blog/lets-encrypt-without-dns-api): Keep your DNS provider and automate DNS-01 through a delegated challenge record. Learn what SimpleACME changes and what your ACME client still handles.
- [Windows certificates with win-acme and SimpleACME DNS-01](https://simpleacme.com/blog/win-acme-windows-dns01): Prepare DNS-01 validation for IIS and Windows services using win-acme, a permanent CNAME and SimpleACME's account-specific update credentials.
- [Traefik DNS-01 with SimpleACME: prepare the account before renewal](https://simpleacme.com/blog/traefik-dns01-simpleacme): Connect Traefik's ACME-DNS provider to an existing SimpleACME registration. Keep the challenge CNAME and persistent account storage ready for automatic renewals.
- [Certbot DNS-01 hooks without a DNS-provider API token](https://simpleacme.com/blog/certbot-dns01-hooks-simpleacme): Use Certbot authentication hooks with a delegated SimpleACME challenge record. Separate TXT updates, propagation checks and certificate deployment.
- [Reduce DNS credential exposure in certificate automation](https://simpleacme.com/blog/secure-dns-validation-without-zone-api-keys): Compare full-zone tokens, scoped DNS credentials and delegated ACME challenge accounts. Learn where SimpleACME narrows the DNS write surface.
- [HTTP-01 vs DNS-01: choose the easier certificate workflow](https://simpleacme.com/blog/http-01-vs-dns-01): Compare HTTP-01 and DNS-01 for public websites, private services and wildcard certificates. See when SimpleACME removes the DNS-provider API work.

## Frequently asked questions

### Can I automate certificates without a DNS-provider API?
Yes. Add the challenge CNAME supplied by SimpleACME once, then configure an existing SimpleACME registration in your ACME client. Later TXT updates go to SimpleACME rather than your normal DNS provider. You still need permission to edit that CNAME.

### Can my application stay private without opening port 80?
Yes. DNS-01 validates a publicly resolvable challenge record instead of an inbound HTTP challenge endpoint. The issuing client still needs the relevant outbound connectivity. Use a public DNS name you control, even if the application is reached on a private network.

### Can SimpleACME help with wildcard certificates?
Yes. DNS-01 supports wildcard validation. A certificate for *.example.com can match first-level names such as app.example.com and vpn.example.com. It does not automatically cover example.com or app.team.example.com. Request any additional certificate names deliberately.

### Do I need to move my DNS, website or email?
No. Your normal DNS zone, website and email records remain with your provider. Only the challenge name is delegated using its CNAME. SimpleACME does not become a reverse proxy for your application.

### Is the same CNAME used for future renewals?
Yes, while you keep the same registration and delegation. The CNAME remains in place; the TXT authorization value behind it changes. You need one CNAME per distinct configured challenge owner name, rather than one for an entire unrelated collection of names.

### Which ACME clients can I use?
The documented workflows cover Traefik with its ACME-DNS provider, win-acme with a PowerShell DNS hook, and Certbot with authentication hooks, including Docker. Configure the existing registration from your account. Client versions and application deployment requirements still need review.

### Does SimpleACME issue certificates or store my private key?
No. Your ACME client requests and renews certificates with the certificate authority and handles private keys. SimpleACME manages delegated TXT challenge updates. Installation, application bindings and reloads remain part of your deployment workflow.

### What can I prepare with a free account?
You can create an account and prepare one single-domain demo, including its challenge CNAME. The demo cannot send /update requests. Paid single-domain and wildcard registrations are created after accepted subscription payment.

### What happens if I stop renewal, pause, or receive a refund?
Paid DNS-update access remains available until its original paid-through date even if provider renewal is paused or canceled. Pausing or resuming does not extend that date. Approved refunds, including partial refunds, and chargebacks immediately block updates. Already-issued certificates remain valid until their own expiry.

### Can the timeline confirm that my certificate was renewed?
The timeline records TXT authorization changes, not confirmed certificate issuance or installation. Compare those events with your ACME client logs and the certificate actually served. Optional DNS-change email notifications are available in account settings.

### Can I use my own script with the update endpoint?
Yes. POST JSON containing the assigned subdomain and 43-character TXT authorization value to https://simpleacme.com/update with X-Api-User and X-Api-Key headers. Use the existing account credentials, keep secrets private, handle HTTP errors and wait for DNS visibility before continuing validation.

### Can an AI assistant help configure my client?
Yes, if its client supports connecting to a remote MCP server. The public SimpleACME MCP at /mcp supplies service information, integration guidance and starter script templates. It does not receive your private key, create registrations, execute scripts or perform DNS updates. Connection is opt-in and support varies by AI client.

## Traefik DNS-01 without a DNS-provider API token
Keep certificate automation in your reverse proxy. Delegate the challenge with one CNAME and configure the ACME-DNS provider with an existing SimpleACME registration.
Create and activate the intended domain in your SimpleACME account. Add and verify its exact challenge CNAME.
Populate the ACME-DNS account storage with the existing registration from your account. Anonymous /register is not available.
Set ACME_DNS_API_BASE=https://simpleacme.com and ACME_DNS_STORAGE_PATH to the persistent account file inside Traefik. Use provider: acme-dns in your resolver.
Protect the registration and ACME certificate storage. Use staging first, attach the resolver to the intended router, then request production certificates.
Monitor client renewal and the served certificate. The SimpleACME timeline covers TXT changes, not installation.

## Windows DNS-01 with win-acme and SimpleACME
Validate Windows service names without a public HTTP challenge endpoint. Use existing SimpleACME credentials in a reviewed PowerShell DNS hook.
Prepare and activate the domain, then add and verify the exact challenge CNAME.
Store the account mapping in a protected application-data folder readable by the renewal task identity.
Select win-acme DNS script validation. Its create hook must send the supplied authorization value, fail on update errors and wait for DNS visibility.
Select the intended certificate store and application installation step. For IIS, prefer the supported IIS installation integration when it fits.
Test in staging, save the renewal and verify the scheduled task can read credentials and deploy unattended.

## Certbot DNS-01 with a permanent CNAME
Use Linux or Docker authentication hooks to publish the DNS proof through SimpleACME. Keep your certificate keys and deployment under your control.
Prepare an active SimpleACME domain and its verified challenge CNAME.
Store the existing registration securely and map each intended hostname to the right registration.
Use a manual authentication hook that reads CERTBOT_VALIDATION, posts the assigned subdomain and TXT value to /update, checks HTTP errors and waits for propagation.
Run certbot certonly --staging --manual --preferred-challenges dns with your reviewed authentication and cleanup hooks, using a separate test certificate name.
Create the production renewal without --staging, retain one renewal scheduler and configure a deployment hook. With Docker, persist the whole certificate directory through bind mounts.