Technical Notes · SSL/TLS · ACME Protocol · Root Access VPS
ACME DNS-01 Challenge Notes
Working notes on validating domain ownership with the ACME DNS-01 challenge for wildcard and internal-hostname SSL certificates on a Hoststack Linux VPS — what it is, when to use it over HTTP-01, and how to automate renewal with root access.
See Linux VPS PlansWhat the DNS-01 Challenge Involves
A quick reference for engineers issuing certificates via Let's Encrypt or another ACME-compatible CA on Hoststack infrastructure.
TXT Record Proof
The CA asks you to publish a _acme-challenge TXT record with a token it supplies, proving control of the DNS zone rather than the web server.
Wildcard Certificates
DNS-01 is the only challenge type that supports wildcard certs (*.example.com) — HTTP-01 cannot issue them.
No Port 80 Needed
Because validation happens at the DNS layer, DNS-01 works even when port 80/443 is firewalled or the host isn't publicly reachable yet.
DNS API Automation
Certbot and acme.sh support dozens of DNS provider plugins so the TXT record can be created and removed automatically during renewal.
Root SSH on VPS
Hoststack Linux VPS plans ship with full root access, so you can install Certbot, acme.sh, or any ACME client directly and schedule renewals via cron or systemd timers.
90-Day Renewal Cycle
Let's Encrypt certificates are valid for 90 days. DNS-01 automation is what makes unattended renewal practical for wildcard and multi-subdomain setups.
DNS-01 vs HTTP-01: Which Challenge to Use
The ACME protocol (used by Let's Encrypt, ZeroSSL, and other free/automated CAs) offers a few validation methods, but the two you'll hit in practice are HTTP-01 and DNS-01. HTTP-01 asks the CA to fetch a file from http://yourdomain/.well-known/acme-challenge/<token> — simple, but it requires port 80 to be reachable and only proves control of that one hostname.
DNS-01 instead asks you to publish a TXT record at _acme-challenge.yourdomain containing a signed token. Because the proof lives in DNS rather than on a specific server, DNS-01 is the only option for wildcard certificates, works for internal or firewalled hosts, and lets you issue one cert covering many subdomains without opening inbound ports.
When DNS-01 makes sense on a Hoststack VPS
If you're running a wildcard cert for multiple subdomains on one Linux VPS, issuing certs for a host that sits behind Hoststack's DDoS protection network on non-standard ports, or automating cert issuance for internal services that aren't exposed to the public internet, DNS-01 is usually the right challenge type.
Setting It Up on a Hoststack Linux VPS
Hoststack's Linux VPS plans (KVM, AMD Ryzen 5 5500 or Intel Xeon E5-2673 v4, from ₹399/mo) give you unmanaged root access on Ubuntu, Debian, or CentOS, so nothing about the ACME client is restricted.
- Install acme.sh or Certbot with root SSH access — no panel restrictions.
- If your DNS is hosted with a provider that has a Certbot DNS plugin (Cloudflare, Route53, etc.), configure API credentials and let the client manage TXT records automatically.
- If your registrar has no automation API, you'll add/remove the TXT record manually each renewal — acme.sh's manual mode will pause and print the record to add.
- Schedule renewal via cron or a systemd timer; test with --dry-run before relying on it for production wildcard certs.
- Reload Nginx/Apache/whatever web server you're running after each successful renewal (a --deploy-hook is the standard pattern).
Because this is unmanaged VPS hosting, Hoststack support can help with platform-level issues (networking, VPS provisioning, panel access) but scripting your own ACME renewal hooks is on you — that's the trade-off for full root control at ₹399/mo instead of a managed plan.
FAQ
ACME DNS-01 questions
Need root access for your own ACME automation?
Hoststack Linux VPS from ₹399/mo — KVM, full root SSH, Ubuntu/Debian/CentOS, Mumbai & Delhi data centers.
See Linux VPS Plans