Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?
Short answer
In HTTP-01, the ACME server sends a validation request to port 80 of the domain name and TR7 answers it itself through the selected HTTP vService; no additional credentials are required, but the domain name must reach TR7 from the internet on port 80. In DNS-01, TR7 writes an _acme-challenge TXT record with the API of the DNS provider in the ACME DNS Providers profile; the vService does not need to be reachable from the internet. Since a wildcard name (*.example.com) has no single server, control of the domain name must be proven at the DNS level; this is why ACME accepts only DNS-01 for wildcards.
Comparison
| HTTP-01 | DNS-01 | |
|---|---|---|
| Proof | The response of the http://<domain>/.well-known/acme-challenge/<token> address | The _acme-challenge.<domain> TXT record |
| How in TR7 | The HTTP vService selected in the row answers the validation request itself; the request does not go to the Backend Service | The record is written with the API of the DNS provider and is deleted after the validation |
| Requirement | The domain name must resolve to the frontend IP of the vService, and port 80 must be open from the internet | API access at a supported DNS provider |
| Additional record | None | Certificates & PKI → ACME DNS Providers profile; selected in the DNS Provider field in the certificate form |
| Wildcard | No | Yes |
| vService type | HTTP | HTTP, L7 TCP |
Challenge Type is HTTP-01 by default. In both methods, a vService is selected for each name in the Domain and vService table of the certificate form; obtaining the certificate step by step is described on the Can I get certificates automatically with Let's Encrypt / ACME? page.
Why DNS-01 for Wildcards?
HTTP-01 proves, for a specific name, control of the server of that name. *.example.com, on the other hand, covers countless subdomains; no single server represents all of them. DNS-01, in contrast, proves management of the example.com zone, so it is valid proof for all the subdomains. TR7 also enforces this rule in the form: when a wildcard name is entered while HTTP-01 is selected, the form gives the Wildcard domains require the DNS-01 challenge error.
Common Misconceptions
- "HTTP-01 works on every vService type." The validation request is answered only through an HTTP vService; for an L7 TCP vService, DNS-01 is used.
- "DNS-01 also works for internal domain names." The ACME server looks up the record in public DNS; the domain name must be in a public DNS zone.
- "When DNS-01 is selected, there is no need to select a vService." In the Domain and vService table, a vService is still selected for each row.
- "Port 80 can be closed because HTTPS is on." If HTTP-01 is used, port 80 must stay open for the validation at every renewal.
How it is done in the documentation
