Ad

acme-dns on Ubuntu 24.04 LTS

Azure Security

acme-dns, a limited scope DNS server with a REST API, purpose built to answer ACME DNS-01 challenges without exposing your production DNS zone.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

acme-dns is an open source, deliberately minimal DNS server with a small RESTful HTTP API, built for a single job: answering the DNS-01 challenges that certificate authorities use to verify domain control. Rather than giving certificate automation broad credentials for your real DNS provider, you delegate one dedicated subdomain to acme-dns and point a CNAME at it, so each enrolled client can update only its own private subdomain and nothing else. It runs as one static binary with an embedded datastore, and every major ACME client already speaks its three endpoint API.

Why the cloudimg image

The cloudimg image is hardened and fully patched, with acme-dns preconfigured and running as a dedicated unprivileged service that holds only the capability it needs to bind low ports. It ships with no default, shared or example credentials: first boot mints a per instance TLS certificate for the API, generates a challenge zone unique to that instance, enrols its API account through the product's own registration endpoint, and proves the path end to end before completing. A start time guard refuses to serve any published example configuration. Every instance is backed by a paired deploy guide and 24/7 cloudimg support.

Common uses

  • DNS-01 certificate issuance without production DNS credentials
  • Wildcard certificates for internal and private hosts
  • Per client challenge accounts scoped to one subdomain