DNS-01 vs HTTP-01: Which TLS Validation to Pick

This guide explains the differences between DNS-01 and HTTP-01 domain validation for TLS certificates, helping you choose the right method for your setup. You’ll learn how each works, their pros and cons, and the exact steps to decide based on your infrastructure. By the end, you’ll know which validation fits your needs and how to implement it correctly.

What You’ll Need

• Access to your domain’s DNS settings (for DNS-01)
• Control over the web server or hosting for the domain (for HTTP-01)
• A TLS certificate client like Certbot, acme.sh, or a hosting panel’s built-in tool
• Basic understanding of DNS records and web server configuration

Step-by-Step

1. Understand the two validation methods.
   HTTP-01 validation works by placing a specific file on your web server at a well-known URL (e.g., http://example.com/.well-known/acme-challenge/<token>). The certificate authority (CA) fetches that URL over port 80 to confirm you control the domain. DNS-01 validation instead requires you to add a TXT record to your domain’s DNS zone (e.g., _acme-challenge.example.com). The CA queries the DNS to verify the record exists.
2. Assess your domain setup.
   Ask: Can you easily edit DNS records? Do you have a web server that’s publicly reachable on port 80? If you have a hosting panel or DNS provider with an API, DNS-01 is often easier to automate. If you only have FTP or file manager access to a web server, HTTP-01 is simpler.
3. Check for wildcard certificate needs.
   If you need a certificate that covers multiple subdomains (e.g., *.example.com) or you want to issue one certificate for many domains without configuring each web server, DNS-01 is the only option. HTTP-01 cannot validate wildcard domains.
4. Evaluate port accessibility.
   HTTP-01 requires port 80 to be open and reachable from the internet. If your server is behind a firewall that blocks port 80, or if you use a CDN that doesn’t forward the challenge path, HTTP-01 will fail. DNS-01 only needs DNS resolution, so it works even if port 80 is closed.
5. Consider automation and renewal.
   For automated renewal, both methods can be automated, but DNS-01 often requires API access to your DNS provider. If your provider offers an API (e.g., Cloudflare, AWS Route 53), you can set up automatic TXT record creation. HTTP-01 automation is simpler if your web server software supports it (like Certbot’s webroot plugin).
6. Weigh security and propagation time.
   DNS-01 records are visible in DNS and can be queried by anyone; they expire after a short time, but they may be cached. HTTP-01 challenges are temporary and removed after validation. DNS-01 can take longer due to DNS propagation delays, especially if you use multiple DNS servers. HTTP-01 is usually faster because it’s a direct HTTP request.
7. Make your choice based on your environment.
   Choose HTTP-01 if: you have a single domain or a few domains, you have direct control over the web server, port 80 is open, and you don’t need wildcards. Choose DNS-01 if: you need wildcards, you have multiple domains across different servers, port 80 is restricted, or you want to centralize certificate management via DNS.
8. Implement the chosen method.
   For HTTP-01 with Certbot: run certbot certonly --webroot -w /var/www/html -d example.com. For DNS-01 with Certbot: use a plugin like certbot-dns-cloudflare and configure your API credentials. For manual DNS-01: create the TXT record and wait for propagation before running the certificate issuance command.
9. Test the renewal process.
   After issuing your certificate, test renewal with certbot renew --dry-run (or equivalent) to ensure the validation method works automatically. For DNS-01, confirm the TXT record is created and deleted correctly.

Common Mistakes

• Using HTTP-01 for wildcard certs: It simply won’t work. You must use DNS-01.
• Not opening port 80: If your firewall blocks port 80, HTTP-01 fails. Check your security group or firewall rules.
• DNS propagation delays: With DNS-01, if you don’t wait long enough, the CA may not see the TXT record. Use a tool like dig to verify propagation.
• Incorrect TXT record name: The record must be exactly _acme-challenge.yourdomain.com. A common mistake is adding the record under the wrong subdomain.
• Leaving old TXT records: After validation, remove the TXT record to avoid clutter and potential security risks.

Tips

• Use a DNS provider with API: If you choose DNS-01, pick a provider with a well-documented API to automate the process.
• Set up monitoring: Monitor certificate expiry and renewal logs to catch issues early.
• Use staging environment first: Test with Let’s Encrypt’s staging server to avoid rate limits while you figure out the process.
• Consider a reverse proxy: If you use a reverse proxy, ensure it forwards the /.well-known/acme-challenge/ path correctly.

Troubleshooting

• HTTP-01 fails with 404: Check that the challenge file is in the correct web root and that the URL is exactly as the CA expects. Ensure no redirects are interfering.
• DNS-01 times out: Verify the TXT record is published and propagated. Use dig TXT _acme-challenge.example.com to check. If not visible, wait longer or check your DNS provider’s propagation status.
• Renewal fails after initial success: For DNS-01, ensure your API credentials are still valid and the DNS provider hasn’t changed. For HTTP-01, verify the web server still points to the correct directory.
• Port 80 blocked but you still want HTTP-01: You can temporarily open port 80 during validation, but this is not ideal for automation. Consider switching to DNS-01.

Frequently Asked Questions

Can I use HTTP-01 for a wildcard certificate?

No, HTTP-01 only validates a single domain. For wildcards, you must use DNS-01.

Which method is faster?

HTTP-01 is usually faster because it’s a direct HTTP request. DNS-01 can be delayed by DNS propagation, sometimes taking minutes to hours.

Do I need to open port 80 for DNS-01?

No, DNS-01 only requires DNS access. You can close port 80 entirely if you use DNS-01.

Can I automate DNS-01 without a DNS provider API?

Yes, but you’ll need a manual step to add the TXT record each time. Some tools support ‘manual’ mode where you copy the record and paste it into your DNS panel.

Is one method more secure than the other?

Both are equally secure for domain validation. DNS-01 exposes a temporary TXT record that could be queried, but it’s harmless. HTTP-01 is transient and removed immediately.

Can I switch from HTTP-01 to DNS-01 later?

Yes, you can reissue your certificate with a different validation method. Just run the issuance command again with the new method.

Related

• Future-Proof Your Test Automation Pipeline
• Dummy RAM: What It Is and How to Spot It
• Recover Deleted Photo Folder: Step-by-Step Guide