ACME HTTP/DNS Validation (Let’s Encrypt example)

ACME HTTP/DNS Validation (Let’s Encrypt example) A workflow diagram generated by Archify. 01 / 1. User · cert-manager 02 / 2. ACME protocol 03 / 3. Challenge solvers 04 / 4. Let's Encrypt 05 / 5. Result Create Certificate CR · kubectl apply · 1. User · cert-manager Create Certificate CR kubectl apply Create CertificateRequest · Controller detects Certificate · 1. User · cert-manager Create CertificateRequest Controller detects Certificate Create Order · domain list · 2. ACME protocol Create Order domain list Authorization · per-domain authorization · 2. ACME protocol Authorization per-domain authorization Challenge · prove ownership · 2. ACME protocol Challenge prove ownership Finalize · request issuance · 2. ACME protocol Finalize request issuance HTTP-01 · /.well-known/acme-challenge/ · 3. Challenge solvers HTTP-01 /.well-known/acme-challenge/ DNS-01 · _acme-challenge TXT record · 3. Challenge solvers DNS-01 _acme-challenge TXT record Verify domain ownership · HTTP request or DNS query · 4. Let's Encrypt Verify domain ownership HTTP request or DNS query Issue certificate · returns signed certificate · 4. Let's Encrypt Issue certificate returns signed certificate Store in Secret · tls.crt + tls.key · 5. Result Store in Secret tls.crt + tls.key success Legend User cert-manager Challenge solvers Secret ACME resources Let's Encrypt

HTTP-01 solver

  • • Proves domain ownership through a web server (Ingress controller)
  • • The /.well-known/acme-challenge/ token path must be reachable on port 80

DNS-01 solver

  • • Proves domain ownership with a DNS TXT record
  • • Required for wildcard certificates
  • • Route 53 uses temporary credentials (IRSA/Pod Identity) and DNS permissions

Validation scope

  • • Reused authorizations may not require new challenges
  • • ACM ACME uses administrator-validated domains and EAB registration