{"id":5053,"date":"2026-11-09T08:48:21","date_gmt":"2026-11-09T08:48:21","guid":{"rendered":"https:\/\/certera.com\/blog\/?p=5053"},"modified":"2026-11-04T09:18:10","modified_gmt":"2026-11-04T09:18:10","slug":"acme-validation-methods-compared","status":"publish","type":"post","link":"https:\/\/certera.com\/blog\/acme-validation-methods-compared\/","title":{"rendered":"Compare ACME validation: HTTP-01, DNS-01, TLS-ALPN-01, DNS-PERSIST-01"},"content":{"rendered":"\n

By March 15, 2029, maximum certificate lifetimes will fall to 47 days (down from 398), and domain validation reuse will drop to 10 days, with step-downs in 2026 and 2027 along the way. The challenge is no longer a small, snaggy setup concern; it\u2019s now a design choice of what you need to renew.<\/p>\n\n\n\n

This is a practical decision-making and comparison guide to assess the options and select that which has demonstrated to ensure the smooth flow of certificates.<\/p>\n\n\n\n

Which ACME Method Should You Use?<\/h2>\n\n\n\n

HTTP-01 will work if you keep port 80 open and you have a certificate authority that is able to access the specific path on your server. When a wildcard needs to be used, or the host itself is unreachable from the public network, the DNS-01 will become the practical solution. TLS-ALPN-01 is designed to work when only you control TLS termination on 443, and port 80 is closed.<\/p>\n\n\n\n

DNS-PERSIST-01 is changing the game. You don’t write a new TXT record every validation; rather, you publish one authorisation that is valid forever, attaching a domain to a particular CA and ACME<\/a> account.<\/p>\n\n\n\n

The next time there’s a renewal of the DNS object, it renews without any further DNS changes and eliminates a recurring write, propagation delay, and credential distribution for DNS-01. Make a selection based on the constraint you cannot eliminate.<\/p>\n\n\n\n

Key Takeaways<\/h2>\n\n\n\n

HTTP-01<\/strong> is designed to work with a normal web server that does not require wildcard certificates and does not open up port 80. The method is only more complicated if the path becomes unreachable: The certificate authority is responsible for fetching a file from a known file path.<\/p>\n\n\n\n

DNS-01<\/strong>\u00a0supports wildcard certificates<\/a> and any host that you can’t reach on the public internet. It is a control mechanism that relies on a temporary TXT record, which is effective even when an inbound connection to the server is not possible.<\/p>\n\n\n\n

If no other port is available, and you are the complete TLS terminator, then TLS-ALPN-01 applies. Validation happens during a specific handshake, so once a CDN or load balancer intercepts TLS, the method fails.<\/p>\n\n\n\n

DNS-PERSIST-01 is ideal for environments where the number of records is high or if you need to keep records to a minimum, but want to minimise the time it takes to update the records each time they expire. One such continuing authorisation record eliminates the need for those repeated writes and credentials.<\/p>\n\n\n\n

What Each ACME Method Actually Proves<\/h2>\n\n\n\n

The four mechanisms mentioned above are all in effect for Domain Control Validation (DCV). Each one is merely a measure of control on a different level.<\/p>\n\n\n\n

The HTTP-01 “firewalls” establish control of the Web content.  <\/p>\n\n\n\n

A one-time token is used to demonstrate control of the DNS zone in DNS-01.  <\/p>\n\n\n\n

TLS-ALPN-01 is used to control and prevent the TLS endpoint.  <\/p>\n\n\n\n

DNS-PERSIST-01 allows you to persistently authorise a specific CA and ACME account on the DNS zone.<\/p>\n\n\n\n

Side-by-Side Comparison of All Four Methods<\/h2>\n\n\n\n
Challenge<\/strong><\/td>Validates via<\/strong><\/td>Wildcards<\/strong><\/td>Port needed<\/strong><\/td>DNS writes<\/strong><\/td>Best for<\/strong><\/td>Renewal overhead<\/strong><\/td><\/tr>
HTTP-01<\/td>HTTP file on port 80<\/td>No<\/td>80<\/td>None<\/td>Public web servers with open port 80<\/td>Low<\/td><\/tr>
DNS-01<\/td>Temporary TXT record<\/td>Yes<\/td>None<\/td>Every validation<\/td>Wildcards or unreachable hosts<\/td>Medium<\/td><\/tr>
TLS-ALPN-01<\/td>Special TLS handshake<\/td>No<\/td>443<\/td>None<\/td>Closed port 80 with full TLS control<\/td>Low<\/td><\/tr>
DNS-PERSIST-01<\/td>Persistent authorization record<\/td>Yes<\/td>None<\/td>Once (setup only)<\/td>High-volume or restricted-DNS environments<\/td>Very low<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Which Method Should You Choose?<\/h2>\n\n\n\n

Start with the constraint you cannot remove. The first match in the list below usually gives you the method that will keep working.<\/p>\n\n\n\n

If this is true<\/strong><\/td>Use<\/strong><\/td>Why<\/strong><\/td><\/tr>
You need a wildcard<\/td>DNS-01 or DNS-PERSIST-01<\/td>Only DNS methods can validate a wildcard<\/td><\/tr>
Host is not reachable from the public internet<\/td>DNS-01 or DNS-PERSIST-01<\/td>CA queries public DNS and never contacts the host<\/td><\/tr>
Port 80 is closed and cannot be opened<\/td>TLS-ALPN-01 or a DNS method<\/td>HTTP-01 requires port 80<\/td><\/tr>
CDN or managed load balancer terminates TLS<\/td>DNS method<\/td>You cannot control the ALPN protocol on their terminator<\/td><\/tr>
DNS updates are manual or owned by another team<\/td>HTTP-01<\/td>Avoids credentials and propagation delays<\/td><\/tr>
None of the above applies<\/td>HTTP-01<\/td>Simplest option with fewest failure points<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Use a staggered starting point, working down the rows in sequence. If the wildcard or unreachable host turns up, then the two DNS methods remain the only outstanding ones. HTTP-01 is removed further (usually TLS-ALPN-01 too) by closed port 80 or a third-party TLS terminator. In the absence of all those constraints, of course, HTTP-01 is the lowest-friction option.<\/p>\n\n\n\n