In short
HTTP-01 is the easy default for publicly reachable web servers with port 80 open. You need DNS-01 for wildcard certificates, internal hosts without public web access and setups with several servers behind a load balancer.
| Criterion | HTTP-01 | DNS-01 |
|---|---|---|
| Proof via | File under /.well-known/acme-challenge/ over HTTP | TXT record _acme-challenge.<domain> |
| Wildcard certificates | Not possible | Possible, only via DNS-01 |
| Requirement | Port 80 reachable from the internet, A/AAAA point to the server | Write access to the DNS zone, usually through an API |
| Internal hosts | Only if publicly reachable on port 80 | Yes, the host itself does not need to be reachable |
| Multiple servers / load balancer | Challenge must exist on every backend or be answered centrally | Independent of where the request lands |
| Speed | Immediate once the file is served | Depends on the DNS API and on all authoritative servers updating |
| Security risk | Low, only the web server is involved | A DNS API key on the server can often change the whole zone |
| Typical failure | Wrong AAAA record, redirects, firewall, CDN in front | Missing API permissions, waiting too short, nameservers out of sync |
Pick HTTP-01 if …
- the server is public and port 80 may stay open.
- you need certificates for individual, fixed hostnames.
- there is no DNS API access, or you do not want API keys spread across servers.
- your web server or reverse proxy has ACME built in, such as Caddy or Traefik.
Pick DNS-01 if …
- you need a wildcard certificate like
*.example.com. - the host is internal, such as a mail server, an admin interface or a lab system.
- port 80 must stay closed for security reasons.
- several servers behind a load balancer share the same certificate.
Pitfalls from operations
- Let's Encrypt also validates HTTP-01 over IPv6. A stale AAAA record pointing elsewhere breaks validation even though IPv4 is fine.
- A global HTTP to HTTPS redirect is fine; redirecting
/.well-known/to another host or a login page is not. - DNS-01: restrict API tokens to the zone or record where possible, or delegate
_acme-challengevia CNAME to a separate validation zone. - Reload the service after renewal. Many expired certificates had in fact been renewed, but nginx or Postfix was still serving the old one.
FAQ
Can I mix HTTP-01 and DNS-01?
Yes, names in one order can be validated differently, and different certificates on the same server can use different challenges. For maintenance, one method per server is easier to keep track of.
Why does DNS-01 sometimes take so long?
The TXT record has to be visible on all authoritative nameservers of the zone before Let's Encrypt checks. Many clients therefore wait a fixed time, and if it is too short, validation fails.