Certificates & Site Ops
HTTP-01 vs DNS-01 for Let's Encrypt
Choose the right validation method for issuance and renewal based on your hosting, DNS control, and certificate scope.
In brief
What it is: HTTP-01 and DNS-01 are both ACME challenge types, but they fit different infrastructure and certificate goals.
Why it matters: Choosing the right challenge method affects whether issuance and renewal stay simple or become brittle.
Worth knowing: Choose the challenge with renewals, wildcard coverage, DNS control, and automation in mind.
Most Let’s Encrypt setup friction comes down to challenge selection. HTTP-01 is often straightforward for a public web server you control. DNS-01 is more flexible for wildcard certificates and some complex environments, but it depends on DNS access and automation.
Pick the challenge that will renew reliably, not just the one that gets the first certificate issued fastest.
How the challenge methods differ
- HTTP-01 proves control through web content served over HTTP for the requested domain.
- DNS-01 proves control by placing the required record in DNS and is required for wildcard certificates.
- Renewal reliability matters more than one-time setup speed.
| Factor | HTTP-01 | DNS-01 |
|---|---|---|
| Typical fit | Standard websites on reachable web servers | Wildcards, split environments, DNS-automated setups |
| Needs web server access | Yes | No |
| Needs DNS changes | No | Yes |
| Wildcard support | No | Yes |
Common wrong turns
- Choosing HTTP-01 for a wildcard certificate request.
- Picking DNS-01 without a realistic plan for DNS updates and renewal automation.
- Testing issuance once and never checking whether the same path still works months later.
Decision questions
Which challenge is easier for beginners?
Often HTTP-01 on a simple public website, because it avoids DNS automation.
Which one is better for long-term automation?
That depends on your environment, but DNS-01 is often more flexible when the web tier is not the right place for validation.
Do this locally (CLI)
Use these as conceptual starting points only after you decide which challenge method actually fits your environment.
# HTTP-01 style issuance (example shape)
certbot certonly --webroot -w /var/www/example -d example.com
# DNS-01 style issuance (example shape)
certbot certonly --manual --preferred-challenges dns -d '*.example.com' -d example.com
- Adapt the DNS example to the provider's supported automation and the production renewal workflow.
- Wildcard certificates require DNS-01, even if HTTP-01 worked for a non-wildcard host.
