Use Certbot’s DNS-01 challenge when you need a wildcard certificate, cannot expose a web server on port 80, or want validation to happen on a different machine. Certbot’s provider plugin creates a TXT record at _acme-challenge.<your-domain>; Let’s Encrypt checks that record and issues the certificate when the value is correct.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
For unattended operation, install the DNS plugin for your authoritative DNS provider, give it a narrowly scoped API token, request every required name with certbot certonly, and schedule certbot renew. Always test with --dry-run and reload services after a successful renewal.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What DNS validation proves
Let’s Encrypt’s DNS-01 challenge proves that you control a domain by requiring a specific, token-derived value in a TXT record under that domain. For example.com, the record is published at _acme-challenge.example.com. For a name below the apex, such as api.example.com, the challenge is normally at _acme-challenge.api.example.com.
Certbot asks the DNS provider to create the record, waits for authoritative DNS servers to return it, and then asks Let’s Encrypt to validate the challenge. Once validation succeeds, Certbot stores the certificate and private key locally. The TXT record is temporary and the DNS plugin normally removes it after validation.
When DNS-01 is the right challenge
- Wildcard certificates: DNS-01 is the Let’s Encrypt challenge that can issue names such as
*.example.com. HTTP-01 cannot issue wildcard names. - No public web server: The machine running Certbot does not need to answer an HTTP request on port 80.
- Separate validation host: You can run Certbot on a secured administration host while the eventual HTTPS service runs elsewhere.
- Nonstandard or private web infrastructure: Validation does not depend on routing a temporary HTTP file to a particular application server.
DNS-01 does not remove the need for publicly resolvable DNS. Let’s Encrypt must be able to query the authoritative servers for the name and observe the TXT value.
Check your names, DNS provider and access first
Write down the exact names that must appear in the certificate. A wildcard covers one label, so *.example.com covers www.example.com and api.example.com, but not example.com itself or *.深.example.com. Request the apex separately when it is needed.
Recommended Free Tools
Pre-flight checklist
- Confirm that you control every requested domain and that its authoritative DNS provider is known.
- Decide whether a wildcard is actually required. Listing only the hostnames you use reduces certificate scope.
- Identify an API-capable DNS provider and the Certbot plugin for it. Documented provider families include Cloudflare, DigitalOcean, DNSimple, DNS Made Easy, Google, Linode, LuaDNS, NS1, OVH, RFC2136, Route 53 and Sakura Cloud.
- Ensure the host running Certbot can reach the provider API and make outbound HTTPS requests.
- Choose a protected location for the API credential file. Anyone who can use a credential with broad DNS rights may be able to redirect or take over services under the domain.
Install Certbot and the DNS plugin
Install Certbot using the package method appropriate for your operating system. A default Certbot installation does not include provider DNS plugins; each certbot-dns-<provider> plugin is installed separately. Use the package and installation instructions maintained for your operating system and provider.
After installation, verify that the command is available:
certbot --versionThen install the matching plugin. The package name and installation command differ by distribution, but the plugin itself follows this naming pattern:
certbot-dns-<provider>Do not install a plugin for a DNS service that is not authoritative for the requested name. If your domain uses delegated or split DNS, check the NS records at the parent zone and identify the provider that actually answers publicly.
Create a least-privilege DNS credential
Use a provider API token limited to the zone and actions needed to create and remove TXT records. Avoid placing a full-account password or unrestricted DNS key on a web server. Let’s Encrypt warns that a compromise of a host holding full DNS credentials can affect every record in the account.
Credential design
- Restrict the token to the single DNS zone whenever the provider supports zone scoping.
- Allow record read and write operations only if the plugin requires both. Do not grant billing, account-administration or unrelated service permissions.
- Store the token in a root-readable file outside the web document root.
- Set permissions so ordinary users cannot read it, for example:
sudo chown root:root /etc/letsencrypt/dns-provider.ini
sudo chmod 600 /etc/letsencrypt/dns-provider.iniUse the credential-file path and option documented by your chosen plugin. Never paste a live token into a command that will remain in shell history or process listings. Rotate the token if the host, backup, logs or administrator account may have exposed it.
Request a certificate with an automatic DNS plugin
The basic provider-specific form is:
sudo certbot certonly --dns-<provider> -d example.com -d '*.example.com'Replace <provider> and the credential options with the syntax documented by that plugin. certonly obtains or renews the certificate but does not edit your web-server configuration.
Wildcard and apex certificate
To cover the bare domain and all one-label subdomains, request both names:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo certbot certonly --dns-<provider>
-d example.com
-d '*.example.com'The shell quotes around the wildcard prevent the shell from expanding the asterisk before Certbot receives it. Add more explicit names only when they are required; for example, a deeper name needs its own certificate name or wildcard strategy.
Ordinary hostnames without a wildcard
For a certificate covering only the apex and a web host, request those names directly:
sudo certbot certonly --dns-<provider>
-d example.com
-d www.example.comCertbot may ask you to choose a certificate name if a lineage with the same names already exists. Keep one deliberate lineage per deployment and remove obsolete lineages only after confirming that no service still references them.
What happens during issuance
- Certbot generates a challenge token for each authorization.
- The DNS plugin calls the provider API and publishes one or more TXT values below
_acme-challenge. - Certbot waits according to the plugin’s propagation behavior, then asks Let’s Encrypt to check the records.
- After successful validation, Let’s Encrypt issues the certificate and Certbot removes the temporary TXT records when the plugin supports cleanup.
- Certbot writes the resulting lineage and renewal options under its configuration directory.
Do not delete a TXT value while validation is pending. Multiple TXT values can legitimately exist at the same owner name when several authorizations are active; remove only stale values after the challenge has completed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the TXT record when issuance fails
Most DNS-01 failures are caused by publishing the value in the wrong zone, querying before propagation, or using credentials that cannot modify the authoritative provider.
Check the exact owner name
The record owner is relative to the DNS zone in many provider interfaces. If the provider already displays example.com as the zone, entering _acme-challenge.example.com may create an unintended name such as _acme-challenge.example.com.example.com. Follow the provider’s field convention and confirm the fully qualified result.
Check authoritative answers
Inspect the TXT response through a DNS diagnostic tool or the provider’s DNS view. Query the authoritative nameservers, not only a local recursive resolver. The value returned must exactly match the value Certbot requested, including punctuation and capitalization where applicable.
Allow for propagation
Providers publish changes at different speeds, and cached negative answers can delay visibility. The plugin’s propagation wait and timeout controls vary by provider, so use the current documentation for that plugin rather than assuming one universal delay. If the provider is consistently too slow, a delegated challenge zone can isolate validation from the primary DNS service.
Review permissions and logs
- Confirm that the token can edit the authoritative zone, not merely a secondary or parked zone.
- Check Certbot’s output for authentication, authorization and propagation errors.
- Verify that the server clock is correct; large time errors can break API authentication and certificate operations.
- Run the command again only after removing or correcting stale TXT records and permissions. Repeated requests create unnecessary authorizations and can encounter Let’s Encrypt rate limits.
Use manual DNS when no plugin is available
Certbot’s manual authenticator can pause and tell you which TXT value to publish. You then create the record at _acme-challenge.<domain>, wait for public DNS visibility, and continue the Certbot prompt.
sudo certbot certonly --manual --preferred-challenges dns
-d example.com -d '*.example.com'Manual DNS supports wildcard certificates, but it is not unattended by default. A certificate obtained this way will not renew automatically unless you provide authentication hooks that perform the DNS update and cleanup.
Automating manual mode with hooks
An authentication hook receives challenge information and can call your DNS provider or an internal deployment system. A cleanup hook removes the TXT record afterward. Hooks must be executable, securely stored and tested with a nonproduction account or staging validation before they are trusted for renewal. If a hook fails to remove records, stale TXT values may accumulate; if it publishes the wrong owner name, every renewal will fail.
Delegate only the ACME challenge zone
You do not have to put your primary DNS provider’s credentials on the Certbot host. Create a separate validation zone and delegate _acme-challenge with a CNAME or NS record to that zone or to another DNS provider that has an API. Let’s Encrypt follows standard DNS delegation for these challenges.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy delegation helps
- The production DNS account can remain inaccessible to the renewal host.
- The delegated provider can expose only the records needed for ACME validation.
- Different teams can operate application DNS and certificate validation independently.
Delegation adds operational work: the CNAME or NS records must remain in place, the delegated zone must be authoritative, and the Certbot plugin must update the target name correctly. Test the complete chain from a public resolver before relying on it for renewal.
Find and deploy the issued files
Certbot maintains stable symlinks for each certificate lineage under:
/etc/letsencrypt/live/<certificate-name>/The two files most TLS services need are:
fullchain.pem— the server certificate followed by the issuing chain.privkey.pem— the private key. Treat it as secret and grant access only to the service that must read it.
Point your reverse proxy, web server, load balancer or application to those stable paths instead of copying timestamped files. Confirm that the service account can read the private key without making the key world-readable.
Reload after a successful renewal
Renewal writes new files, but a running service may continue using the old certificate until it reloads. Use a deploy hook:
sudo certbot renew
--deploy-hook /usr/local/sbin/reload-webserverThe hook runs after a certificate is successfully renewed, not after every renewal attempt. Make the script perform a configuration check before reloading where your server supports one, return a nonzero status on failure, and log the result so an operator can investigate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Automate renewal and test it safely
Let’s Encrypt and Certbot documentation describe short-lived certificates. A 90-day lifetime cited in Let’s Encrypt and Certbot documentation from the 2023-era reference makes automation an operational requirement, not an occasional maintenance task.
Schedule the renewal command
Use your operating system’s scheduled service, timer or cron facility to run:
certbot renewThe renew subcommand reuses the plugin and options saved during issuance and attempts renewal only for certificates close to expiry. Current Certbot documentation describes the threshold as less than one-third of the certificate lifetime for certificates longer than ten days.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Do not create a second scheduler if your package already installed one. Check the existing timer or scheduled job, then ensure its logs and exit status are monitored.
Run a staging dry run
Before depending on unattended renewal, execute:
sudo certbot renew --dry-runThe dry run uses Let’s Encrypt’s staging service and does not save production certificates. It exercises the saved DNS plugin configuration, credential access, propagation behavior and renewal hooks without replacing the live certificate. A successful dry run is evidence that the path works, but continue monitoring the real scheduled job.
Test deployment separately
After a dry run, verify that the deploy hook can reload the actual service and that the service presents the new chain. Check the certificate’s names, expiration date and chain from a client outside the server. If the reload fails, fix the hook before the next production renewal rather than waiting for expiry.
Choose the validation method that fits your infrastructure
| Method | Wildcard support | Port 80 required | Automation | Main trade-off |
|---|---|---|---|---|
| DNS provider plugin | Yes | No | Automatic when the provider API and credentials work | Requires a DNS API token on the renewal host |
| Manual DNS | Yes | No | Manual unless authentication and cleanup hooks are written | Human intervention or custom automation is required at renewal |
| HTTP-01/webroot | No | Yes; the challenge file must be reachable over HTTP | Usually straightforward for ordinary hostnames | Depends on web routing and cannot issue wildcard certificates |
| CNAME/NS delegated challenge zone | Yes | No | Automatic through the delegated provider’s plugin or hooks | Reduces primary-DNS exposure but adds delegation complexity |
Security and reliability practices
- Use a dedicated validation host when practical, especially if the production web server does not need DNS administration access.
- Keep the API credential file out of backups and support bundles that are broadly accessible, or encrypt those backups.
- Limit firewall egress and account permissions to what the plugin requires, while allowing DNS API access and outbound connections needed for validation.
- Monitor certificate expiration and renewal failures. A scheduled command that exits unsuccessfully is not automation unless someone receives the alert.
- Keep Certbot and the DNS plugin maintained through your operating system’s normal update process. Provider APIs and authentication requirements can change.
- Retain the previous working certificate until the replacement has been validated and the service reload has succeeded.
Troubleshooting by symptom
“DNS problem: NXDOMAIN”
The owner name is probably in the wrong zone, the delegation is missing, or the provider has not published the record. Check the authoritative nameservers and the fully qualified _acme-challenge name.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems“TXT record not found”
Wait for propagation, query more than one authoritative server, and confirm that the exact value generated by Certbot is present. A local resolver may still be serving a cached negative response.
“Invalid response from the DNS API”
Verify the token scope, zone identifier, credential-file permissions and plugin/provider pairing. An API token for a different account or nonauthoritative zone cannot complete DNS-01.
Validation succeeds but the service still shows the old certificate
Certificate issuance and service deployment are separate steps. Inspect the files under /etc/letsencrypt/live/<certificate-name>/, confirm the service points to those paths, run its configuration test, and reload it with the deploy hook.
Renewal prompts for manual input
The lineage was created with manual DNS or a hook that is missing or not executable. Install and configure a provider plugin, or repair the authentication and cleanup hooks before the certificate approaches expiry.
Quick Recap
End-to-end operating procedure
- List the exact apex, hostname and wildcard names required.
- Find the authoritative DNS provider and select its Certbot DNS plugin.
- Install Certbot and that plugin using the supported package method for your operating system.
- Create a narrowly scoped API token and store its credential file with restrictive permissions.
- Run
certbot certonlywith every required-dname, including the apex separately when a wildcard is used. - Confirm the certificate lineage and stable files under
/etc/letsencrypt/live/<certificate-name>/. - Configure the TLS service to use
fullchain.pemandprivkey.pem, then reload it. - Verify the certificate from an external client and record the renewal owner and credential location.
- Schedule
certbot renewusing the package’s existing timer or scheduler. - Run
certbot renew --dry-run, correct any DNS or hook errors, and configure a deploy hook for successful renewals.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
