# SimpleACME

> Delegated DNS-01 challenge automation with one permanent CNAME per challenge owner. No normal DNS-provider API token or inbound HTTP challenge endpoint.

## Product facts
SimpleACME manages TXT challenge updates, not certificate issuance, private keys or installation. The customer's ACME client performs those tasks. Paid yearly access is required for /update. One single-domain demo can prepare DNS but cannot update it. Provider pause/cancel does not shorten the paid term; approved refunds and chargebacks disable updates. TXT activity is not proof of a completed certificate renewal.

## Documentation
- [DNS provider directory](https://simpleacme.com/dns-providers)
- [Self-updating sitemap](https://simpleacme.com/sitemap.xml)
- [Published article RSS](https://simpleacme.com/blog/feed.xml)
- [Service](https://simpleacme.com/)
- [FAQ](https://simpleacme.com/faq)
- [Client integration and MCP](https://simpleacme.com/developers)
- [Traefik](https://simpleacme.com/integrations/traefik)
- [win-acme](https://simpleacme.com/integrations/win-acme)
- [Certbot](https://simpleacme.com/integrations/certbot)
- [OpenAPI](https://simpleacme.com/openapi.json)

## MCP
Endpoint: https://simpleacme.com/mcp
Transport: Streamable HTTP, JSON responses, protocol 2025-11-25. Public read-only setup guidance and placeholder configuration generation. No credentials, registration or DNS mutation tools. Connect explicitly from a compatible client; availability does not imply automatic discovery by all AI systems.

## Public articles
- [One permanent CNAME for repeated certificate renewals](https://simpleacme.com/blog/permanent-cname-certificate-renewals): Understand how a fixed ACME challenge CNAME points to changing TXT authorization values, and how to preserve it across renewals and DNS migrations.
- [Wildcard certificates with one permanent challenge CNAME](https://simpleacme.com/blog/wildcard-certificates-one-cname): Secure first-level subdomains using wildcard DNS-01 validation. Understand wildcard coverage, the apex name and permanent CNAME delegation with SimpleACME.
- [Troubleshoot DNS-01 certificate failures in the right order](https://simpleacme.com/blog/troubleshoot-acme-dns01): Diagnose CNAME, authentication, DNS propagation, client and deployment failures separately. Use SimpleACME's TXT timeline as one part of the evidence.
- [Certificates for private services without opening port 80](https://simpleacme.com/blog/private-services-without-port-80): Use public DNS validation for private dashboards, VPNs and management interfaces. SimpleACME removes the need for a public HTTP challenge endpoint.
- [Let's Encrypt without a DNS-provider API: one CNAME is enough](https://simpleacme.com/blog/lets-encrypt-without-dns-api): Keep your DNS provider and automate DNS-01 through a delegated challenge record. Learn what SimpleACME changes and what your ACME client still handles.
- [Windows certificates with win-acme and SimpleACME DNS-01](https://simpleacme.com/blog/win-acme-windows-dns01): Prepare DNS-01 validation for IIS and Windows services using win-acme, a permanent CNAME and SimpleACME's account-specific update credentials.
- [Traefik DNS-01 with SimpleACME: prepare the account before renewal](https://simpleacme.com/blog/traefik-dns01-simpleacme): Connect Traefik's ACME-DNS provider to an existing SimpleACME registration. Keep the challenge CNAME and persistent account storage ready for automatic renewals.
- [Certbot DNS-01 hooks without a DNS-provider API token](https://simpleacme.com/blog/certbot-dns01-hooks-simpleacme): Use Certbot authentication hooks with a delegated SimpleACME challenge record. Separate TXT updates, propagation checks and certificate deployment.
- [Reduce DNS credential exposure in certificate automation](https://simpleacme.com/blog/secure-dns-validation-without-zone-api-keys): Compare full-zone tokens, scoped DNS credentials and delegated ACME challenge accounts. Learn where SimpleACME narrows the DNS write surface.
- [HTTP-01 vs DNS-01: choose the easier certificate workflow](https://simpleacme.com/blog/http-01-vs-dns-01): Compare HTTP-01 and DNS-01 for public websites, private services and wildcard certificates. See when SimpleACME removes the DNS-provider API work.