Apr 11, 2026 · Written by: Netspare Team

TLS Certificates in 2026: ACME, HTTP-01, DNS-01, and Wildcard Domains

Automated certificate authorities such as Let’s Encrypt use ACME challenges to prove you control the domain. HTTP-01 is simple behind a single web server; DNS-01 unlocks wildcards and origins hidden from the public web.

Renewal is not magic—firewall changes, CDN “orange cloud” modes, and stale credentials break automation silently until users see browser warnings.

HTTP-01: how it works and fails

The CA asks your ACME client to serve a random token at `http://<domain>/.well-known/acme-challenge/...`. Any reverse proxy must forward that path to the machine running the client.

If only HTTPS is exposed or WAF rules block the path, validation fails—test with curl from the public internet.

DNS-01: wildcards and internal names

DNS-01 requires a TXT record at `_acme-challenge.<domain>`. It suits wildcard certificates and split-horizon setups where HTTP cannot reach the origin.

You must protect API keys for DNS providers; leaked tokens are full domain takeover vectors.

Renewal windows and monitoring

Let’s Encrypt certs are 90-day by design—automate, don’t calendar-reminder manually.
Alert on cert expiry at 14/7/1 days as a backstop even if automation exists.
After migrating CDN or proxy, rerun a forced renewal in staging.

Cipher suites and protocol versions

Disable TLS 1.0/1.1 for public sites; keep TLS 1.2+ with modern AEAD ciphers. Test with SSL Labs or `openssl s_client` after changes.

HTTP/2 and HTTP/3 have their own ALPN requirements—certificate problems mask as protocol downgrade errors.

Frequently asked questions

Can I get a certificate for an IP address from Let’s Encrypt?

No—domain names only. For IPs you need a different CA workflow.

Why did renewal work on server A but not B?

Challenge routing differs. HTTP-01 must hit the instance running the client; DNS-01 needs the same API credentials and correct zone scope.

Netspare Team