Which DCV Method Should You Automate?

How it works

1. You request a certificate from the CA (e.g., Let's Encrypt).
2. The CA gives you a token.
3. You create a TXT record: _acme-challenge.yourdomain.com → "<token>"
4. The CA queries DNS, finds the token, and validates that you control the domain.
5. The certificate is issued.

The tradeoff

You need programmatic access to your DNS provider. This means:

• API credentials for Cloudflare, Route53, Azure DNS, Google Cloud DNS, etc.
• Or a DNS provider that supports RFC 2136 dynamic updates
• Or delegation via CNAME to a DNS provider you do control

How it works

1. You request a certificate from the CA.
2. The CA gives you a token and a thumbprint.
3. You place a file at: http://yourdomain.com/.well-known/acme-challenge/<token>
4. File contents: <token>.<thumbprint> (your ACME client builds this for you).
5. The CA makes an HTTP request to port 80, retrieves the file, and validates the response.
6. The certificate is issued.

How it works

1. You request a certificate from the CA
2. CA gives you a token
3. Your server presents a self-signed certificate on port 443 with:
   • A special ALPN protocol: acme-tls/1
   • The token embedded in a certificate extension
4. CA connects to port 443, negotiates ALPN, reads the token from the cert
5. Certificate issued

"I'm running Kubernetes"

Recommended: cert-manager with DNS-01 (most flexible) or HTTP-01 (simpler for ingress)

cert-manager is the de facto standard for Kubernetes certificate automation. HTTP-01 is easiest to start with (works with nginx-ingress, traefik), but DNS-01 is what you'll want once you need wildcards or multiple clusters.

Common pattern: HTTP-01 via Ingress for simple services, DNS-01 via ClusterIssuer using cloud-native DNS APIs for wildcards and multi-cluster deployments.

"I'm behind Cloudflare / AWS CloudFront / Fastly"

Recommended: DNS-01

CDNs cache and intercept HTTP traffic, which breaks HTTP-01. The challenge request goes to the CDN edge, not your origin. Use DNS-01, or configure CDN to bypass cache for /.well-known/acme-challenge/*.

HTTP-01 bypass rules are brittle—DDoS protection or WAF rule changes can silently break certificate renewals. DNS-01 avoids this fragility.

"I have a simple VPS with Nginx or Apache"

Recommended: HTTP-01 with certbot

This is the "5-minute setup" scenario. Certbot can automatically configure Nginx or Apache:

# Nginx
sudo certbot --nginx -d example.com -d www.example.com

# Apache
sudo certbot --apache -d example.com -d www.example.com

"I need wildcard certificates for microservices"

Recommended: DNS-01 (only option)

Wildcard certificates require DNS-01. There's no workaround—HTTP-01 and TLS-ALPN-01 cannot validate wildcards. Set up DNS-01 automation with your DNS provider's API:

certbot certonly --dns-cloudflare -d "*.example.com" -d "example.com"

"My server has no public IP"

Recommended: DNS-01

If your server can't receive inbound connections from the internet, DNS-01 is your only option. The validation happens entirely via DNS queries—no connection to your server required.

Common examples: Internal ADCS replacements, internal web apps that need public-trust certs on reverse proxies, dev/staging environments, servers behind corporate NAT, air-gapped networks with outbound-only DNS.