Setting Up DNS-01 Validation with Cloudflare

Wildcard certificates require DNS-01 validation specifically — there's no HTTP-based alternative for them. If your DNS is hosted on Cloudflare, most ACME clients support automating this validation through Cloudflare's API, so a wildcard certificate can renew unattended just like a standard one.

1. Create a scoped API token

In the Cloudflare dashboard, go to My Profile → API Tokens → Create Token, and use the "Edit zone DNS" template, scoped to the specific zone (domain) you need. Avoid using your Global API Key for this — a scoped token limited to DNS editing on one zone means a leaked credential can't be used to touch anything else in your Cloudflare account.

2. Configure Certbot's Cloudflare plugin

pip install certbot-dns-cloudflare --break-system-packages

# ~/.secrets/cloudflare.ini
dns_cloudflare_api_token = your_token_here

chmod 600 ~/.secrets/cloudflare.ini

certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  -d "*.yourdomain.com" -d "yourdomain.com"

Certbot handles the rest automatically: creating the required _acme-challenge TXT record via the API, waiting for it to propagate, requesting validation, and removing the record afterward.

3. Confirm renewal is genuinely automated

certbot renew --dry-run

Since the credentials file is already saved, a scheduled renewal (via cron or systemd timer, covered in our dedicated automation guide) will use the same DNS-01 flow with no manual intervention required going forward.

What to do if propagation checks keep failing

Certbot's Cloudflare plugin waits a configurable amount of time for DNS propagation before requesting validation — the default is usually sufficient, but if you're seeing intermittent validation failures specifically, increasing the wait explicitly with --dns-cloudflare-propagation-seconds 30 (or higher) gives slower-propagating changes more room before the CA checks.

Using acme.sh instead of Certbot

export CF_Token="your_token_here"
acme.sh --issue --dns dns_cf -d "*.yourdomain.com" -d "yourdomain.com"

acme.sh's Cloudflare integration works the same way conceptually — an API token with DNS edit permission, referenced via an environment variable rather than a credentials file — and is a reasonable alternative if you're already using acme.sh for other certificates and want a consistent tool across your infrastructure.

A note on Cloudflare proxying and this specific process

The DNS-01 challenge record itself doesn't go through Cloudflare's proxy (the orange-cloud icon) regardless of whether your domain's other records are proxied — TXT records used for domain validation aren't the kind of record Cloudflare's proxy applies to. Whether your actual site traffic is proxied through Cloudflare is a separate, unrelated setting that doesn't affect this validation process either way.