HTTP-01 validates a file over HTTP on port 80. DNS-01 validates a TXT record at _acme-challenge. TLS-ALPN-01 validates a special TLS response on 443. Wildcard certificates need DNS-01. For a regular site, choose the route you can automate and verify on every renewal.
ACME issues a certificate after proof of control over an identifier. The client selects a challenge from those offered by the CA. Let’s Encrypt documents the three common challenge types. HTTP-01 and DNS-01 are specified in RFC 8555; TLS-ALPN-01 is specified in RFC 8737. A reliable renewal route matters more than one successful manual issuance.
What each method validates
| Method | Validation route | Useful for | Constraint |
|---|---|---|---|
| HTTP-01 | http://name/.well-known/acme-challenge/... on 80 | Ordinary public website | No wildcard; the token must reach the right server |
| DNS-01 | TXT at _acme-challenge.name | Wildcard, internal service, no inbound HTTP | Secure DNS API access or manual work on each renewal |
| TLS-ALPN-01 | TLS on 443 with acme-tls/1 ALPN | Client controls the TLS terminator | Proxy must pass the special handshake; no wildcard |
HTTP-01 cannot be validated on an arbitrary port. Redirects are allowed within CA rules, but a CDN or redirect can send validation to the wrong host. With DNS-01, inspect the public authoritative zone: a local recursive cache can lag. Compare authoritative and recursive answers with the dig guide before retrying.
Choose by infrastructure constraints
For *.example.com, use DNS-01 with narrowly scoped DNS credentials. If the website is reachable on 80 and the ACME client controls the web server, HTTP-01 is often easier to maintain. If 80 is closed but the client controls the external TLS endpoint on 443, TLS-ALPN-01 may work. With a CDN, inspect where TLS terminates and where /.well-known/ routes; your internal nginx may never see the validation request. The s_client guide shows how to inspect the public certificate.
Before automating, identify who owns DNS API credentials, the web root and the proxy. Give DNS-01 credentials the least privilege and keep them out of source control. For HTTP-01, route the exact challenge path. Multiple frontends need a shared token backend or consistent routing. Check apex DNS records and TTL if delegation recently changed.
Preflight without issuing a certificate
dig +short TXT _acme-challenge.example.com
curl -i http://example.com/.well-known/acme-challenge/test-token
openssl s_client -connect example.com:443 -servername example.com -alpn acme-tls/1 </dev/null
# Use the client dry-run against a staging CA for a real challenge.These commands check routes, not successful authorization: the ACME client creates the token and TLS response. Certbot documents a dry-run against staging. Then inspect the renewal timer and log. Match an “unauthorized” response to the actual challenge: HTTP 404 suggests path routing, missing TXT suggests DNS publication, and wrong ALPN suggests the TLS terminator. Exact log wording varies between clients.
How we made this guide
The comparison uses RFC 8555, RFC 8737 and Let’s Encrypt guidance. The commands are preflight examples, not evidence that we issued a certificate. We reviewed Google US and Yandex Moscow results through SerpAPI. Wordstat region 225 returned no estimate for the exact phrase and 9 for the broader Russian query certbot dns 01. Search volume does not measure protocol security.
FAQ
Can HTTP-01 issue a wildcard?
Let’s Encrypt requires DNS-01 for wildcard names.
Does TLS-ALPN-01 require port 80?
The challenge itself uses 443. Ensure your external TLS endpoint accepts the special ALPN.
Why can I see the TXT record but the CA cannot?
Check authoritative nameservers, delegation, the exact record name and recursive caching.
When use DNS-01 without a wildcard?
When inbound HTTP is unavailable or an internal service needs a certificate, provided DNS updates can be automated safely.
