Do the LetsEncrypt DNS01 challenges change and how to they interoperate with HTTP challenges?

Question

I typically use HTTP challenges to generate LetsEncrypt certs. However, there are some cases where this is not practical. I've not used DNS challenges before

So a couple of related questions -

1. Do the DNS challenges remain the same across renewals? (https://letsencrypt.org/2019/10/09/onboarding-your-customers-with-lets-encrypt-and-acme.html vaguely implies not as it talks about the need to change the DNS if the provider changes - but I could easily be misinterpreting this.

2. If I start off using a DNS challenge, will renewals automatically use the same challenge - ie does the same certbot -q renew automatically know which certs require HTTP challenges and which ones require DNS challenges if I have both running on my server?

Answer 1

Do the DNS challenges remain the same across renewals?

No, it doesn't. Based on my experience the DNS challenges are different every renewal. So, I need to add/edit TXT record every renewal

Will renewals automatically use the same challenge

No, I have dozens of domain using DNS challenges in different servers. I need to run the same command as I create/register the certificate. If I run certbot -q renew will return an error if have any of DNS challenge Cert but work well if just HTTP challenge.

I just share my experience, maybe I am wrong because of the wrong setup. my setup command is:

certbot  certonly  -d *.domain.com -d domain.com --server https://acme-v02.api.letsencrypt.org/directory --preferred-challenges dns --manual --installer apache