Use Certbot’s DNS-01 challenge when you need a wildcard certificate, cannot expose port 80, or want validation to happen independently of the web server. Certbot’s provider plugin creates a temporary TXT record at _acme-challenge.<your-domain>; Let’s Encrypt checks that record, issues the certificate, and the plugin removes the record. For unattended operation, install the DNS plugin for your authoritative provider, use a narrowly scoped API token, schedule certbot renew, test with the staging service, and reload your server after renewal.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What DNS validation proves
Let’s Encrypt’s DNS-01 challenge proves that you control a domain by requiring a specific token-derived value in a TXT record under that domain. The record name is _acme-challenge.<domain>. Once Let’s Encrypt can retrieve the expected value from authoritative DNS, it can issue the requested certificate.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
DNS-01 is the only Let’s Encrypt challenge method that supports wildcard names such as *.example.com. It is also useful when the computer running Certbot is separate from the web server, when inbound HTTP is restricted, or when a service is not publicly reachable on port 80.
Decide which names and challenge method you need
Request only the names you will use
Every -d option adds a name to the certificate. A certificate for example.com does not automatically cover www.example.com, and a wildcard does not cover the base domain. If both are needed, request both explicitly:
sudo certbot certonly --dns-<provider> -d example.com -d '*.example.com'For ordinary hostnames without a wildcard, request the exact names:
sudo certbot certonly --dns-<provider> -d example.com -d www.example.comKeep the wildcard in single quotes so a Unix shell does not expand the asterisk before Certbot receives it.
Compare the available validation approaches
| Method | Wildcard certificates | Port 80 dependency | Automation | Main operational concern |
|---|---|---|---|---|
| DNS provider plugin | Yes | No | Automatic when the provider API works | Protecting DNS API credentials and allowing time for propagation |
| Manual DNS-01 | Yes | No | Not unattended unless an authentication hook updates DNS | A person must create the TXT record for each issuance or renewal |
| HTTP-01/webroot | No | Yes; the challenge file must be reachable over HTTP | Usually automatic for supported web-server setups | Port 80 routing and public reachability |
| Delegated challenge zone (CNAME or NS) | Yes | No | Automatic through the delegated provider | Extra DNS delegation design and maintenance |
Find the authoritative DNS provider
The plugin must update the provider that is authoritative for the names you request. Check the domain’s delegation and identify which nameservers answer authoritatively. If a subdomain is delegated separately, its authoritative provider may differ from the provider for the parent domain.
Document the exact zone and record name before issuing. For example.com, the usual challenge owner name is _acme-challenge.example.com. For a name under a delegated subdomain, follow that zone’s DNS boundaries rather than assuming the parent provider is authoritative.
Install Certbot and the matching DNS plugin
Install Certbot for your operating system
Install Certbot using the package method recommended for your operating system, then install the separate DNS plugin for your provider. DNS plugins are not included in a default Certbot installation; the plugin package must be added separately.
Provider families with documented Certbot DNS plugins include Cloudflare, DigitalOcean, DNSimple, DNS Made Easy, Google, Linode, LuaDNS, NS1, OVH, RFC2136, Route 53 and Sakura Cloud. Plugin package names and installation commands change by distribution, so use the current instructions for your operating system and the provider plugin you selected.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Confirm the plugin is available
After installation, check Certbot’s available plugins and verify that the provider-specific DNS authenticator appears. If it does not, stop before requesting a certificate: a command that names an unavailable plugin cannot perform DNS automation.
Keep Certbot and its DNS plugin in the same installation environment. A package upgrade, virtual environment change, or replacement host can leave the renewal job using a Certbot binary that no longer has the authenticator installed. Recheck the plugin list after maintenance and before the next scheduled renewal.
Create and protect a least-privilege DNS credential
Create an API token or key that can change only the DNS records required for the validation zone. Prefer a token restricted to the specific zone and to record read/write operations, rather than a full-account credential. The exact permission labels vary by provider.
Let’s Encrypt warns that placing broad DNS credentials on a public web server increases the impact of a server compromise. Safer designs include:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Use a narrowly scoped token limited to the validation zone.
- Run DNS validation from a separate machine that does not serve public application traffic.
- Store the credential in the provider plugin’s supported configuration file or secret store, not in source control or a world-readable script.
- Restrict the credential file to the account that runs Certbot (for example, root when Certbot is run with
sudo). - Rotate or revoke the token if the validation host is rebuilt, exposed, or no longer trusted.
Do not paste a real token into a shell history, ticket, or article. Use the plugin’s current documentation for the exact option name and file format; those details differ between providers.
Test the credential with the least privilege you intend to keep. It must be able to create, read, and remove the TXT record in the authoritative zone, but it does not need broad access to unrelated zones or account settings. If your provider separates DNS read and write permissions, grant only what the plugin requires for propagation checks and cleanup.
Issue a certificate with a DNS plugin
Wildcard and base-domain certificate
- Confirm that the plugin package and its credential configuration are installed.
- Run Certbot in certificate-only mode, replacing the provider name and credential options with the values required by that plugin:
sudo certbot certonly --dns-<provider> -d example.com -d '*.example.com' - Read Certbot’s output. The plugin requests a challenge, creates the TXT record, waits for DNS visibility as needed, and asks Let’s Encrypt to validate it.
- When validation succeeds, Certbot stores the certificate lineage and reports the paths to the generated files.
Non-wildcard certificate
Request only the hostnames you need:
sudo certbot certonly --dns-<provider> -d example.com -d www.example.comThe DNS plugin creates and removes the TXT record through the provider API. Do not manually delete a record while a validation is in progress; doing so can cause the challenge to fail.
What Certbot stores
Certbot documents stable paths under /etc/letsencrypt/live/<certificate-name>/. The two files most servers consume are:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesfullchain.pem: the server certificate followed by the required intermediate chain.privkey.pem: the private key; protect it as a secret and grant the web server only the access it needs.
The certificate name in the directory is the lineage name chosen by Certbot. If you issue similar names more than once, Certbot may append a suffix, so use the path printed by the successful run and inspect the live directory before configuring a server.
Keep services pointed at the stable live directory rather than copying a timestamped file from the archive. Certbot updates those stable links when a lineage renews, which lets a deploy hook reload the service without changing its configuration each time.
When the provider has no usable API
Manual DNS-01
Certbot’s manual authenticator can print the TXT value that you must publish yourself. Create the record at the exact owner name Certbot specifies, wait until authoritative DNS serves the value, and then continue the prompt so Let’s Encrypt can check it. This method still supports wildcard certificates and does not require port 80.
Manual certificates do not renew unattended by default. Each renewal requires another TXT-record intervention unless you supply an authentication hook that performs the DNS update and a cleanup hook that removes it. Treat a manual certificate as an operational process, not as a set-and-forget deployment. A scheduled certbot renew job cannot complete a manual prompt when nobody is present.
Delegate only the challenge zone
If the primary DNS provider is slow, lacks an API, or should not hold credentials on the web server, delegate _acme-challenge with a CNAME or NS record to a validation-specific zone and provider. Let’s Encrypt follows these DNS delegations according to DNS standards. This keeps routine application DNS separate from certificate validation, but it adds records, monitoring, and another provider relationship to maintain.
Document the delegation before issuing: record the CNAME or NS target, the authoritative nameservers for the validation zone, and which credential Certbot uses there. A delegation that is present at one resolver but missing from an authoritative server will produce the same validation symptom as a missing TXT record, so verify the complete chain.
Understand DNS propagation and TXT-record behavior
Issuance depends on authoritative DNS servers returning the new TXT value. A plugin may wait for propagation before asking Let’s Encrypt to validate, but the exact delay and controls differ by provider plugin and by DNS infrastructure. Recursive resolver caches, multiple authoritative servers, and DNSSEC or delegation mistakes can all make a newly created record appear inconsistent.
- Check the record at authoritative nameservers, not only through one local resolver.
- Allow the plugin’s documented propagation interval before assuming the token is wrong.
- Do not replace a TXT value that another concurrent validation is using.
- Keep the challenge owner name exactly as Certbot displays it; an extra zone suffix or missing label creates a different record.
When several validations run at once, preserve all active TXT values if your provider supports multiple values at one owner name. Removing another token can break a separate order. This matters when multiple hostnames, wildcard orders, or two Certbot jobs overlap.
Free tools Windows power users keep installed
One-click scans. No signup required.
Verify the certificate and deploy it
Inspect the lineage
After issuance, verify that every requested name appears in the certificate and that the live-path files point to the intended lineage. Confirm file ownership and permissions, especially for privkey.pem. A certificate can be valid while an application still serves an older file copied elsewhere.
Configure the service to use the live paths
Point the TLS-terminating service at the stable live paths rather than at a timestamped archive file. The service must have permission to read the private key. Follow its normal configuration-test command before reloading it.
Reload after renewal
Renewal writes new files, but most long-running servers continue using the old certificate until they reload. Use a deploy hook that runs only after a successful renewal:
sudo certbot renew --deploy-hook /usr/local/sbin/reload-webserverReplace the example path with an executable script that tests the server configuration and performs a graceful reload. Keep the hook idempotent so it is safe when Certbot processes more than one lineage. If a reverse proxy or load balancer terminates TLS, the hook must reload that component, not only the application behind it.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Automate renewal safely
Schedule the renew command
Use the systemd timer, cron job, or scheduled task installed or recommended by your Certbot package to run:
sudo certbot renewThe renew subcommand checks previously obtained certificates and attempts renewal only when they are close to expiry. It reuses the authenticator and options saved during the original issuance, so the DNS plugin and its credential configuration must remain available.
Let’s Encrypt and Certbot documentation describe 90-day certificates in the 2023-era reference material. Because the lifetime is short, renewal automation is an operational requirement. Certbot’s current documentation describes renewal eligibility as less than one-third of the certificate lifetime remaining for certificates whose lifetime exceeds ten days; the exact timing can evolve as certificate lifetimes change.
Do not assume that a successful first issuance proves future renewal will work. Renewal may run under a different scheduled-task environment, account, working directory, or permission set. Use the same non-interactive credential path during testing that the scheduler will use in production.
Recommended Free Tools
Test with the staging service
Before relying on production renewal, run:
sudo certbot renew --dry-runThe dry run uses Let’s Encrypt’s staging service and does not save production certificates. It verifies that the stored plugin options, credentials, DNS permissions, propagation behavior, and deploy hooks still work. A successful dry run is evidence that the path works, but it does not replace monitoring of real renewals.
Monitor the result
- Log the scheduled command’s exit status and output.
- Alert before a certificate’s expiration date if renewal fails.
- After a successful renewal, verify that the service presents the new certificate, not merely that files changed on disk.
- Retest after changing DNS providers, API tokens, host permissions, firewall rules, or the web-server reload script.
Troubleshoot common failures
“Plugin not found” or an unknown authenticator
The provider plugin is separate from Certbot’s default installation. Install the matching certbot-dns-<provider> package for the same Certbot environment, then list plugins again.
TXT record is not found
Check the authoritative nameservers, zone delegation, owner name, and whether propagation time has elapsed. A record created in a non-authoritative zone, or a record with the domain appended twice, will not satisfy the challenge.
Credentials are rejected
Confirm that the token has DNS write permission for the correct zone, has not expired or been revoked, and is readable by the account running Certbot. Remove broad permissions and create a replacement token if you cannot verify its scope.
Validation works manually but renewal fails
Renewal runs non-interactively and reuses the saved authenticator options. Ensure the credential file still exists, its permissions still allow Certbot to read it, the DNS plugin is installed after package upgrades, and no manual prompt is required. Run sudo certbot renew --dry-run to reproduce the renewal path safely.
The certificate renewed but clients still see the old one
Check the service’s configured certificate paths, verify the new certificate dates, test its configuration, and run the deploy hook or graceful reload. If a load balancer or reverse proxy terminates TLS, reload the component that actually presents the certificate.
Operational checklist
- Names include every required hostname and, when applicable, both the base domain and wildcard.
- The selected provider is authoritative for the challenge zone.
- The matching DNS plugin is installed and visible to Certbot.
- The API token is limited to the required zone and DNS operations.
- Credential files are not world-readable and are absent from source control.
- Issuance succeeds and the expected
livepaths exist. certbot renew --dry-runsucceeds using the same non-interactive path as production.- A deploy hook reloads the TLS service after successful renewal.
- Monitoring alerts before expiry and after failed renewal jobs.
Bottom line
For a wildcard or a server that cannot answer HTTP-01, DNS-01 with a provider-specific Certbot plugin is the practical route: publish the token at _acme-challenge, let Let’s Encrypt validate it, and automate the same process through certbot renew. Least-privilege DNS credentials, a tested dry run, and a post-renewal reload are what turn a one-time certificate command into a dependable service.
Frequently Asked Questions
What TXT record does Let’s Encrypt expect for DNS validation?
Certbot obtains a token-derived value and asks you or the DNS plugin to publish it as a TXT record at _acme-challenge.<domain>. Use the exact owner name and value displayed by Certbot. Do not append the zone name twice, and do not remove another active value when concurrent validations are running.
Can Certbot create a wildcard certificate with DNS validation?
Yes. DNS-01 is the challenge method that supports wildcard names. Request the wildcard explicitly, and request the base domain separately when you need it: -d example.com -d '*.example.com'. A wildcard alone does not cover the apex domain.
Do I need port 80 for a DNS-validated certificate?
No. DNS-01 validates control through an authoritative TXT record, so the validation host does not need to answer HTTP on port 80. This is useful for private services, restricted firewalls, and Certbot running on a separate machine.
How do I renew a manual DNS certificate automatically?
Manual DNS certificates require a person to create the TXT record each time unless you provide an authentication hook that updates DNS and a cleanup hook that removes the record. For unattended renewal, use a provider-specific DNS plugin or automate the manual authenticator with hooks.
Why is my TXT record not found even though I created it?
Check that the record was created in the authoritative zone, that the owner name is exactly _acme-challenge.<domain>, and that every authoritative nameserver serves the new value. Allow the plugin’s documented propagation interval. Delegation, DNSSEC, caching, or an extra zone suffix can make a correct-looking record unavailable to Let’s Encrypt.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Where are the renewed certificate files?
Certbot maintains stable files under /etc/letsencrypt/live/<certificate-name>/. Services commonly use fullchain.pem and privkey.pem. Use the lineage name reported by Certbot, because repeated issuance can result in a suffixed directory name.
How can I verify renewal before risking production rate limits?
Run sudo certbot renew --dry-run. Certbot uses Let’s Encrypt’s staging service and does not save production certificates. The test exercises the saved DNS plugin options, credentials, propagation behavior, and deploy hooks.
Why does the old certificate remain active after renewal?
Renewal updates files on disk, but a long-running web server usually continues using its already loaded certificate. Configure a deploy hook such as certbot renew --deploy-hook /usr/local/sbin/reload-webserver, test the service configuration, and reload the component that actually terminates TLS.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
