DNS-01 or HTTP-01 for ACME validation: which challenge fits which topology?

DNS-01 or HTTP-01 for ACME validation: which challenge fits which topology?

When a CA needs to prove you control a domain, which challenge should you choose? RFC 8555 defines several, and the right one is dictated by your infrastructure, not preference.

HTTP-01 asks you to serve a token at /.well-known/acme-challenge/ over port 80. It is simple and needs no DNS API, but it cannot issue wildcards and breaks if port 80 is firewalled or load-balanced across hosts that do not share the token.

DNS-01 asks you to publish a TXT record. It is the only path to wildcard certificates, works when the host is not publicly reachable on port 80, and centralizes validation at the zone — but it requires API access to your DNS provider and is exposed to propagation delays.

TLS-ALPN-01 (RFC 8737) validates over port 443 using a special ALPN protocol, useful when only 443 is open.

— Use HTTP-01 for single-host, port-80-reachable web servers.
— Use DNS-01 for wildcards, internal hosts, and fleets behind a balancer.
— Use TLS-ALPN-01 when 443 is your only open port.

Further reading: RFC 8555 §8; RFC 8737.

Bottom line: topology picks the challenge — wildcards and non-public hosts force DNS-01; everything simple stays on HTTP-01.