ACME HTTP-01 and DNS-01 are two ways a certificate authority checks that you control a domain before it issues SSL. HTTP-01 places a short-lived token on port 80 under /.well-known/acme-challenge/. DNS-01 places a TXT record at _acme-challenge for that name. On our cPanel plans, AutoSSL and Let’s Encrypt use HTTP-01. If a CDN or redirect blocks that path, validation fails even when the site looks fine in a browser.
When HTTP-01 works cleanly
With HTTP-01, the CA connects to the public IP for your hostname on port 80 and reads the token your vhost served. That is the full check. It breaks when a CDN or page rule sends every request—including the challenge—to HTTPS on another origin. The CA follows the redirect, never sees the token on this account, and stops. It also fails if orange-cloud or similar caching answers port 80 with a marketing page instead of the challenge file.
Bypass the CDN for the ACME path, or grey-cloud the name until the certificate is issued. Redirecting HTTP to HTTPS is fine as long as the challenge still reaches this hosting account. Closing port 80 entirely is not fine for AutoSSL.
When you need DNS-01 instead
Wildcards cannot be proven with HTTP-01. Neither can a name that never serves a website. DNS-01 asks you or an API to publish a TXT record the CA can look up. AutoSSL does not call your DNS vendor’s API by default. If you need *.example.com, you either purchase a wildcard certificate or run a DNS-01 client that you renew on schedule. Missing that renewal often shows up as an outage on a busy day.
Which method to choose
On this stack, start with HTTP-01 through AutoSSL for apex, www, addon domains, and mail once DNS points at us with ns1.logicweb.com and ns2.logicweb.com, or with A records aimed here. Reach for DNS-01 when the name cannot serve the token, or when you truly need a wildcard. If a CDN must stay in front at all times, configure it to pass the ACME path, or move issuance to DNS-01 you control. The usual failure is not that Let’s Encrypt prefers DNS. It is that HTTP-01 never reached this vhost. How the certificate chain is installed after validation is covered in a separate article.
Tagged
Was this article helpful?
Be the first to rate this article.
