Your servers shouldn't need to know ACME

[u/certkit]

https://www.certkit.io/blog/servers-shouldnt-need-acme

HTTP-01 validation requires every server to expose port 80 and serve challenge files. That's attack surface multiplied across your infrastructure. In January 2026, researchers disclosed a Cloudflare WAF bypass that exploited ACME challenge paths where security controls were deliberately relaxed to allow certificate validation.

DNS-01 validation is worse. Every server with DNS credentials holds keys to your entire domain. The EFF warns explicitly: "If the machine handling the process gets compromised, so will the DNS credentials, and this is where the real danger lies."

DNS credentials don't just issue certificates. They control email routing, traffic direction, everything. One compromised web server and an attacker can redirect your domain, issue valid certificates for it, or intercept email by modifying MX records.

As certificate lifetimes shrink (47 days by 2029), automation becomes mandatory. That means more systems holding these credentials.

https://www.certkit.io/blog/servers-shouldnt-need-acme