DNS vs. HTTP Validation for SSL/TLS Certificates

Compare DNS and HTTP validation, their requirements, configuration, and automation options.

CertOneDec 13, 20195 min read

Before issuing a certificate, the CA verifies domain control. DNS and HTTP validation are two common methods. This guide explains how they work and when to use each.

1. Validation overview

1. Why validate?

Domain-control validation prevents unauthorized certificate issuance and is a fundamental part of public certificate security.

2. Methods

DNS validation:

Prove control by publishing a specified TXT record
Works without a public web server and supports wildcard issuance

HTTP validation:

Prove control by serving a challenge file at a specified URL
Suitable when you can configure the web server

Email validation:

Validate through an approved administrative email address
Available with some CAs and certificate workflows

2. DNS validation

1. How it works

Validation procedures:

The CA provides a challenge
The applicant publishes the required TXT value
The CA queries DNS to verify it
The CA issues the certificate after validation

TXT record format:

Type: TXT
Name: _acme-challenge or _acme-challenge.www
Value: the required challenge value

2. Advantages

✅ No web-server access required
✅ Supports wildcard as well as non-wildcard names
✅ Can validate multiple domains
✅ Straightforward DNS-based proof

3. Limitations

❌ Requires control of the DNS zone or delegated validation records
❌ DNS propagation may take minutes to hours
❌ Manual DNS workflows require intervention at renewal
❌ Provider support for the required TXT records must be available

4. Suitable use cases

Choose DNS validation when:

Requesting ACME wildcard certificates, which require DNS validation
You cannot configure the web server
The site uses a CDN or load balancer
You need to validate multiple names

3. HTTP validation

1. How it works

Validation procedures:

The CA provides a challenge and expected URL
The applicant serves the required response at that URL
The CA retrieves it over HTTP
The CA issues the certificate after validation

Challenge path:

/.well-known/acme-challenge/CHALLENGE_TOKEN

Challenge response:

The required validation content

2. Advantages

✅ Fast validation, often within minutes
✅ No DNS API access required
✅ Suitable when you can configure the server
✅ Easy to automate with an ACME client

3. Limitations

❌ Requires control of the HTTP endpoint
❌ Requires a reachable HTTP challenge service
❌ Does not support ACME wildcard issuance
❌ CDNs may require challenge-routing configuration

4. Suitable use cases

Choose HTTP validation when:

You can configure the server
You need single-domain or multi-domain certificates
The HTTP service is reachable
You want quick validation

4. Configure DNS validation

1. Manual DNS validation

Step 1: Get the challenge details

The provider displays the TXT record to create
Copy its name and value

Step 2: Add the record

Sign in to your DNS provider
Add the TXT record
Wait for propagation

Step 3: Validate

Click Verify in the certificate provider's interface
The CA checks the DNS record
Issuance follows successful validation

2. Automatic DNS validation with API credentials

CertOne DNS authorization:

Create a DNS authorization in CertOne
Provide the DNS provider API credentials
CertOne creates and removes challenge records automatically
Validation proceeds without manual record changes

Supported providers:

Alibaba Cloud DNS
Tencent Cloud DNS (DNSPod)
Cloudflare
AWS Route 53
GoDaddy
Huawei Cloud DNS
Baidu AI Cloud DNS

3. DNS validation with acme.sh

Configure DNS API access:

# Cloudflare example
export CF_Email="your-email@example.com"
export CF_Key="your-api-key"

# Request the certificate.
~/.acme.sh/acme.sh --issue -d example.com --dns dns_cf

5. Configure HTTP validation

1. Manual HTTP validation

Step 1: Get the challenge details

The provider displays the required file path and content

Step 2: Create the challenge file

# Create the challenge directory.
mkdir -p /var/www/html/.well-known/acme-challenge

# Create the challenge file.
echo "CHALLENGE_RESPONSE" > /var/www/html/.well-known/acme-challenge/CHALLENGE_TOKEN

Step 3: Configure HTTP access

NGINX configuration:

location /.well-known/acme-challenge/ {
    root /var/www/html;
    try_files $uri =404;
}

Apache configuration:

Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
<Directory "/var/www/html/.well-known/acme-challenge/">
    Options None
    AllowOverride None
    Require all granted
</Directory>

Step 4: Complete validation

Click Verify in the certificate provider's interface
The CA retrieves the file over HTTP
Issuance follows successful validation

2. Automatic HTTP validation

Certbot:

sudo certbot certonly --webroot \
  -w /var/www/html \
  -d example.com

acme.sh:

~/.acme.sh/acme.sh --issue \
  -d example.com \
  --webroot /var/www/html

6. Comparison

1. Feature comparison

Feature	DNS validation	HTTP validation
Server access required	❌	✅
DNS control required	✅	❌
ACME wildcard support	✅	❌
Speed	Depends on DNS propagation	Usually fast
Automation	High with API access	High
Typical use	Flexible, including wildcards	Reachable HTTP endpoint

2. Use cases

Choose DNS for:

Wildcard issuance
You cannot configure the web server
The site uses a CDN or load balancer
You need to validate multiple names

Choose HTTP for:

You can configure the server
You need single-domain or multi-domain certificates
You want quick validation
The HTTP service is reachable

7. CertOne validation methods

1. DNS authorization

Features:

Provide DNS provider API credentials
Automate validation
Repeat validation automatically during renewal

Suitable for:

Suitable for automated certificate management
Requires the appropriate DNS API access
Wildcard issuance

2. CNAME validation

Features:

No DNS API credentials required
Add the specified CNAME record
Keep the CNAME record in place for automatic renewal

Suitable for:

Suitable when you prefer not to share DNS API credentials
Requires a one-time DNS configuration
Wildcard issuance

3. HTTP validation

Features:

No DNS record changes required
Configure the server to serve the HTTP challenge
Usually validates quickly

Suitable for:

You can configure the server
You need single-domain or multi-domain certificates
You want quick validation

8. Common issues

1. DNS validation times out

Problem: the DNS challenge cannot be validated in time.

Resolution:

Allow time for DNS propagation, from minutes to hours
Check the record name and value
Query the record with DNS diagnostic tools
Retry validation

2. HTTP challenge is inaccessible

Problem: the CA cannot retrieve the challenge file.

Resolution:

Check the challenge URL and file path
Check the web-server configuration
Check file permissions
Ensure public HTTP access

3. Wildcard validation

Problem: ACME wildcard certificates require DNS validation.

Resolution:

Choose DNS validation
Publish the required TXT record
Or automate it with DNS API authorization

Best practices

1. Method selection

✅ Wildcards: use DNS validation
✅ Reachable server: consider HTTP validation
✅ Automation: use DNS API authorization where appropriate
✅ Multiple names: use supported validation methods for each name

2. Automated management

✅ Automate DNS challenges with API credentials
✅ Use acme.sh or Certbot to automate validation
✅ Configure renewal and deployment

3. Preparation

✅ Arrange DNS or server access in advance
✅ Test challenge files or DNS records
✅ Verify network connectivity

Conclusion

DNS and HTTP validation have different access and deployment requirements. Choose the method that fits your certificate names and infrastructure.

Key points:

✅ DNS supports wildcards without web-server access
✅ HTTP suits reachable server environments
✅ DNS API credentials enable automated challenges
✅ Match the method to your environment

CertOne supports DNS authorization, CNAME validation, and HTTP validation alongside automated certificate management.

1. Validation overview​

1. Why validate?​

2. Methods​

2. DNS validation​

1. How it works​

2. Advantages​

3. Limitations​

4. Suitable use cases​

3. HTTP validation​

1. How it works​

2. Advantages​

3. Limitations​

4. Suitable use cases​

4. Configure DNS validation​

1. Manual DNS validation​

2. Automatic DNS validation with API credentials​

3. DNS validation with acme.sh​

5. Configure HTTP validation​

1. Manual HTTP validation​

2. Automatic HTTP validation​

6. Comparison​

1. Feature comparison​

2. Use cases​

7. CertOne validation methods​

1. DNS authorization​

2. CNAME validation​

3. HTTP validation​

8. Common issues​

1. DNS validation times out​

2. HTTP challenge is inaccessible​

3. Wildcard validation​

Best practices​

1. Method selection​

2. Automated management​

3. Preparation​

Conclusion​

1. Validation overview

1. Why validate?

2. Methods

2. DNS validation

1. How it works

2. Advantages

3. Limitations

4. Suitable use cases

3. HTTP validation

1. How it works

2. Advantages

3. Limitations

4. Suitable use cases

4. Configure DNS validation

1. Manual DNS validation

2. Automatic DNS validation with API credentials

3. DNS validation with acme.sh

5. Configure HTTP validation

1. Manual HTTP validation

2. Automatic HTTP validation

6. Comparison

1. Feature comparison

2. Use cases

7. CertOne validation methods

1. DNS authorization

2. CNAME validation

3. HTTP validation

8. Common issues

1. DNS validation times out

2. HTTP challenge is inaccessible

3. Wildcard validation

Best practices

1. Method selection

2. Automated management

3. Preparation

Conclusion