Choose by the domain and deployment
ACME domain validation proves control of a name before a certificate is issued. HTTP-01 uses a challenge served over HTTP at a defined path. DNS-01 uses a TXT record in DNS. The certificate authority's current documentation is the source of truth for supported challenge behavior.
HTTP-01 is often straightforward for a public website whose HTTP challenge reaches the correct server. DNS-01 can be useful when the service is not publicly reachable and is required by Let's Encrypt for wildcard certificate issuance.
Consider operational access
For HTTP-01, check DNS, port reachability, reverse proxies and which origin serves the challenge path. For DNS-01, ensure the TXT record is published in the authoritative zone and can be observed after DNS propagation. Multiple simultaneous challenges and provider automation can require careful record handling.
Automating DNS changes requires credentials with appropriate scope. Prefer the least privilege supported by the DNS provider, protect the credential and consider delegating a challenge subdomain where the design and provider allow it.
Verify renewal, not just issuance
Install the certificate on every intended endpoint and confirm the certificate and chain actually served to clients. Test renewal in a safe environment or with the certificate authority's staging service before relying on automation.
Monitor expiry and renewal failures, document the challenge owner and avoid excessive blind retries that can hit issuance limits. Do not disable TLS verification to conceal an invalid certificate.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.