Tired of manually renew SSL certs for internal services — what's the modern approach?
Hi all I'm the sysadmin at a small company. We run a handful of internal-only services — CRM, ticketing, an internal wiki, a couple of admin dashboards — on our LAN. Not exposed to the internet. Accessed from company laptops and personal phones. Right now we…
Hi all I'm the sysadmin at a small company. We run a handful of internal-only services — CRM, ticketing, an internal wiki, a couple of admin dashboards — on our LAN. Not exposed to the internet. Accessed from company laptops and personal phones. Right now we buy a paid SSL cert from our registrar every year and I install it manually on each service. It's error-prone, someone always forgets, and last time it expired during a customer demo on a Friday afternoon. I want to automate this properly. What I want: auto-renewing, publicly-trusted certs on internal-only services, so phones and laptops don't throw warnings. What I've already ruled out (and why): Internal CA: I'd have to install a root cert on every employee's phone, contractors' devices, BYOD, etc. Firefox on Android is its own headache. Not going down that road. HTTP-01 with public port: security policy won't allow exposing anything to the internet, even briefly. And it's already managed by public websites. DNS-01 with API: our DNS is stuck at a registrar with no API. I can't switch DNS providers or change nameservers — I can only add manual records at need. So I'm stuck between "keep buying yearly certs forever" and "install a private root on 60 devices." Is there something obvious I'm missing? Is there a way to do DNS-01 that doesn't need API access on the main zone (some kind of CNAME delegation trick)? Is anyone doing this cleanly in a similar setup? Thanks in advance.
Collected discussion
Expand the replies to this comment to learn how AI was used in this post/project.
Woowww I was not aware of it. It's not clear to me, can be used today? Or they are still working on it?
We're past the period that they stated for the rollout of that feature, but it's still not listed on the acme challenges page, so I'm not 100% where things stand availability wise right now. I haven't personally tested it.
Because owner do not want. He sees it too risky
Well as the sysadmin its your job to tell him he's wrong. "I can't auto renew ssl certs for internal services because our dns registrar sucks, we need to move to dns registar ABC, this will result in cost savings as I will have more time to XYZ since I won't be manually managing SSL certs anymore" EDIT: oh I didn't realize that your registar is predatory, consider they make you pay for certs (and they seem to explicitly block setting DNS via an api to force customers into paying) so in addition to giving you more free time, you would no longer need to buy certs from this terrible registar
this or caddy. no more damin what port was xyz on, just go to name + ssl. Win win
Sounds like the new DNS-PERSIST-01 challenge is perfect for you https://letsencrypt.org/2026/02/18/dns-persist-01 Mostly the same advantages as DNS-01, but without requiring the provider to have a supported API.
You don't have to move your existing domains, just get another domain from a service that supports API access for DNS records (e.g. Route53 ) and then use CNAME entries to delegate the DNS based ACME challenge to this other domain. CNAME _acme-challenge.any-sub.my-company.com _acme-challenge.any-sub.my-company.com.new-domain.com This has worked for us with both win-acme (Windows servers) as well as go-acme/lego (Linux servers).
https://github.com/acmesh-official/acme.sh/wiki/DNS-persist-mode I'm using acme.sh these days. Still with dns-01 and cname entries for dns alias to redirect the challenge check to a host with dynamic updates. However it got the persistent challenge implemented as well. You could give it a try.
> our DNS is stuck at a registrar why? why can you not move away?
Also, heads up the maximum cert lifetime is going down, so yearly renewals aren't an option anymore. See https://cabforum.org/working-groups/server/baseline-requirements/requirements/ and search for "validity period".
You don't need to renew the certificate from a machine that uses it. You can even renew it on a home server, vps, etc and then transfer it to each server that needs it. Letsencrypt provides free certificates. You can generate one wildcard certificate that works for all subdomains of a domain.
our DNS is stuck at a registrar with no API. I can't switch DNS providers or change nameservers — I can only add manual records at need. Just delegate an internal-only subdomain to something like Route53 or Cloudflare.
Nginx reverse proxy with Lets Encrypt certificate on auto-renewal.
Unless you can convince your employer to switch registrars, It seems that you're stuck with paying for certs until DNS-PERSIST-01 becomes a reality. The only option that comes to my mind is to... continue buying the cert, use a certificate monitoring tool like Uptime Kuma or TrackSSL to notify when the cert is nearing expiration, and automate the process of installing it across the 60 systems using something like Ansible, which would at least be less painful. A possible option for using HTTP-01 would be to install a simple HTTP server (e.g. Lighttpd) somewhere isolated. It just needs a static IP and a DNS record at your registrar. HTTP-01 is just HTTP (port 80) and a text file. It doesn't need to be protected by your enterprise firewall. An HTTP server can run in a $5 USD per month Digital Ocean VPS. What does your company pay for its cert now? Another option could be running the server on an Oracle Always Free VPS.
ran into this exact wall. acme-dns is the fix: a tiny standalone DNS server with its own ACME API. one CNAME at your registrar pointing _acme-challenge.yourdomain to it is all you need on the registrar side.
Do you have the ability to setup a new subdomain on dns? This subdomain could then be setup in another dns provider which has API access. To me this is your best option and means you don't need to change your primary DNS registrar. https://letsencrypt.org/docs/challenge-types/#dns-01-challenge You could also look at tools such as cert mate and certwarden to handle to automatic public cert renewal if you doing want to use certbot. Certkit.io could also help if you have a small setup.
In my company, I host a lot of internal-only services, most of the time only for I.T., and phone are on separate VLAN that can't access this services. Anyway, I set-up Step-CA, publish the root CA by GPO, and use Caddy with ACME to generate and renew certificate. This is internal only, and I have control on every thing.
https://letsencrypt.org/2026/02/18/dns-persist-01
I’m surprised nobody mentioned acme-dns and using a cname on a dedicated domain. This is what a lot of hosting and platform providers use to dynamically provision certs for custom domains. Suppose you have your example.com domain. You create an _acme-challenge.example.com CNAME once (manually) pointing to a domain served by acme-dns. You can run the service on the tiniest cloud instance, a raspberry pi if you can give it has a public static or they also provide a free tier up to 5 domains. Then you register a new domain anywhere where you can change NS and switch it you your acme-dns resolver. You register your example.com domain on acme-dns and you get a uuid to point your cname to. For example: abcdefgijk.example-dns.com Now you can generate wildcard certs from anywhere for *.example.com with Lego or similar tools using letsencrypt for free. https://acmedns.org/ https://github.com/go-acme/lego Ps.: I’m not affiliated with any of the aforementioned technologies. I just finished documenting our cert renewal process after implementing exactly this for both public and private domains.
For my home lab I set up DNS-01 using an instance of acme sitting on vps, and I set the dns entries it requires manually. I have one wildcard cert for my kubernetes cluster ingress, and a few host specific ones for non-kubernes services. This works out very well for letsencrypt renewals. My dns provider doesnt have an API either and I didn't feel like moving it.
You can run a self hosted BIND9 DNS server on a cheap IPv6 only VPS and use acme.sh to renew certificates.
Yes, you can delegate a subdomain (like acme.yourdomain.com) with NS records to a nameserver that supports an API, no need to have a DNS API for the main domain.
Find a public CA you like where you can do organizational validation. Then using ACME protocol since your org is validated you can use external account binding (EAB) instead of per-cert validation via http or dns when enrolling and renewing your cert and provisioning them into their runtimes all using Ansible. Problem solved.
Ran into this exact setup problem at a previous job. acme-dns is a tiny self-hosted server that only handles ACME challenge records. Add a CNAME from _acme-challenge.yourdomain.com to it in your registrar and certbot can validate without any API on your main zone.