I typically use HTTP challenges to generate LetsEncrypt certs. However, there are some cases where this is not practical. I've not used DNS challenges before

So a couple of related questions -

  1. Do the DNS challenges remain the same across renewals? (https://letsencrypt.org/2019/10/09/onboarding-your-customers-with-lets-encrypt-and-acme.html vaguely implies not as it talks about the need to change the DNS if the provider changes - but I could easily be misinterpreting this.

  2. If I start off using a DNS challenge, will renewals automatically use the same challenge - ie does the same certbot -q renew automatically know which certs require HTTP challenges and which ones require DNS challenges if I have both running on my server?

1 Answer 1


Do the DNS challenges remain the same across renewals?

No, it doesn't. Based on my experience the DNS challenges are different every renewal. So, I need to add/edit TXT record every renewal

Will renewals automatically use the same challenge

No, I have dozens of domain using DNS challenges in different servers. I need to run the same command as I create/register the certificate. If I run certbot -q renew will return an error if have any of DNS challenge Cert but work well if just HTTP challenge.

I just share my experience, maybe I am wrong because of the wrong setup. my setup command is:

certbot  certonly  -d *.domain.com -d domain.com --server https://acme-v02.api.letsencrypt.org/directory --preferred-challenges dns --manual --installer apache

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.