We're preparing for shorter certificate renewal periods and want to automate the full lifecycle. We currently use wildcard certificates, so I understand we'll need ACME DNS-01 validation rather than HTTP-01. Does that require a DNS provider with an API, or are there workable alternatives if our primary DNS provider cannot automate challenge records?
After issuance, the certificates need to be installed across several platforms, including NGINX, IIS, and Java keystores. I could build this with PowerShell, but I'm interested in hearing how others handle certificate renewal, deployment, permissions, and security.
3 Answers
I’d first question whether wildcard certificates are needed everywhere. Individual certificates can reduce the impact of a compromised key, even though they create more objects to manage. For the automation itself, an ACME client can handle issuance while deployment scripts or a certificate-management platform distribute the resulting files to NGINX, IIS, and Java keystores. The important parts are renewal testing, service reloads, backups, and clear failure alerting.
For wildcard certificates, DNS-01 is the normal approach. Ideally, use a DNS provider with an API and create narrowly scoped credentials that can modify only the required challenge records. If changing providers isn’t possible, you can delegate the ACME challenge zone with CNAME records to a small DNS service you control programmatically. For internal-only services, consider using an internal CA instead of publicly trusted wildcard certificates.
Security around the DNS credentials and private keys matters as much as the renewal process. Avoid putting broad DNS API credentials on every endpoint, and don’t use one highly privileged management host that can freely reach all systems. Use least-privilege access, keep the private key close to the service that needs it, and centralize approval, auditing, deployment, and revocation where practical. DNS challenge authorizations are temporary, but reducing their lifetime and scope still helps limit the damage from a compromise.
The authorization lifetime has been reduced by public certificate authorities, which lowers the exposure window, but it’s still worth treating DNS credentials and certificate keys as high-value secrets.