How ACME HTTP-01 and DNS-01 Challenges Work Internally
Automated TLS certificate issuance looks simple from the outside. An ACME client requests a certificate, a certificate authority creates a challenge, the client proves control of the requested domain, and the CA issues the certificate. Once the process has been automated, certificate renewal can happen without an administrator manually generating a CSR, uploading validation files, or downloading…
Automated TLS certificate issuance starts with an ACME client requesting a certificate. The certificate authority then generates a challenge to prove control of the requested domain. There are two common challenge mechanisms: HTTP-01 and DNS-01. These mechanisms differ in how they prove domain control through distinct infrastructure paths.
HTTP-01 places a challenge response in the HTTP serving path, while DNS-01 places a cryptographically derived value in the DNS hierarchy. This distinction is crucial in modern environments where the ACME client may run in various systems, including Kubernetes and behind reverse proxies. Understanding ACME involves looking beyond the certificate request itself and considering the broader domain-control verification protocol.
ACME is essentially a domain-control verification protocol. A high-level flow includes creating an order, obtaining an authorization, receiving a challenge object, and achieving a validation result. The CA performs the validation, and the ACME client does not just claim control but modifies an externally observable resource, which the CA then verifies through its own validation infrastructure.
For HTTP-01, the proof is an HTTP resource, and for DNS-01, it is a TXT record under _acme-challenge. Both mechanisms establish domain control but expose it through different infrastructure layers. An ACME authorization contains a challenge token and an account key thumbprint. The client uses this token and information from its account key to construct the required value.
For HTTP-01, this value is placed in the HTTP response, while for DNS-01, it is hashed, base64url-encoded, and published as a TXT record. The cryptographic relationship between the challenge token and the account key makes the account key part of the certificate automation architecture. The ACME client cannot merely submit the expected value through the ACME API; the CA must see the proof through the domain's externally reachable HTTP path or DNS hierarchy.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
