DNS Validation Challenges

DNS validation enables certificate issuance without web server access, ideal for wildcard certificates or internal servers. However, DNS propagation delays and provider-specific APIs complicate automation.

Configure DNS validation:

# Manual DNS validation
certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

# Automated DNS validation with provider plugins
pip install certbot-dns-cloudflare

# Cloudflare credentials
cat > ~/.cloudflare.ini <<EOF
dns_cloudflare_api_token = your-api-token
EOF
chmod 600 ~/.cloudflare.ini

# Obtain certificate
certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.cloudflare.ini \
  -d "*.example.com" \
  -d example.com