Use HTTP-01 for ordinary public web servers, DNS-01 when you need a wildcard certificate or the server is not reachable from the internet, and TLS-ALPN-01 if you build a TLS-terminating proxy that cannot use port 80. If you are unsure, start with your client's default, which is usually HTTP-01.
What a challenge is
Before a certificate authority issues a certificate, it must see proof that you control the names in it. In the ACME protocol that proof is called a challenge. Your ACME client answers it automatically, so most teams never think about it until something fails or a requirement changes, such as needing a wildcard.
The three types side by side
| HTTP-01 | DNS-01 | TLS-ALPN-01 | |
|---|---|---|---|
| Where proof is placed | File under /.well-known/acme-challenge/ on port 80 | TXT record at _acme-challenge.your-domain | Special certificate served on port 443 |
| Wildcards | No | Yes | No |
| Needs public web server | Yes | No | Yes |
| IP address certificates | Yes | No | Yes |
| Client support | Wide | Wide, needs a DNS API to automate | Limited |
These properties come from Let's Encrypt's published documentation, and other ACME authorities follow the same standard.
Choosing in practice
Single public site. HTTP-01 is the easy path. It works with off-the-shelf web servers and needs no knowledge of your DNS. The catch is port 80: it must be reachable, and if you run several servers, the challenge file must be available on all of them.
Wildcards or internal services. Use DNS-01. It works when the web server is not exposed to the public internet and when several servers share a name. The cost is a DNS API your client can call, plus careful handling of the credentials. Putting full DNS API credentials on a web server raises the damage if that server is compromised. Use narrowly scoped credentials, or delegate the challenge name, as covered in how to delegate ACME DNS challenges with a CNAME.
Hosting platforms. TLS-ALPN-01 does the whole check at the TLS layer using a custom ALPN protocol, defined in RFC 8737. That suits authors of reverse proxies, not most application teams.
Failure patterns to watch
- HTTP-01 follows redirects, up to 10 deep, but just to ports 80 and 443.
- DNS-01 can fail on propagation delay. Some providers need a wait of up to an hour unless their API reports when the record is live.
- Old TXT records pile up. Clean them, because an oversized response gets rejected.
- Repeated failures count against rate limits, so debug against staging.
Where Safeguard fits
Safeguard scans dependencies and SBOMs for known vulnerabilities, including those in the TLS and crypto libraries your projects pull in, and you can try it with the free scan at gold.safeguard.sh/scan.
Quick check
Can HTTP-01 issue a wildcard certificate?
No. Wildcard names require DNS-01.
Can I use HTTP-01 on a port other than 80?
No. The ACME standard restricts it to port 80, because arbitrary ports would weaken the check.
Sources
Last reviewed: 19 October 2026.
