Let's Encrypt
Production and staging environments with ordinary ACME account registration, DNS-01 or HTTP-01, ARI enabled by default, and native lego renewal behavior.
Providers and compatibility
Support is reviewed, not inferred.
AcmeMux exposes a curated subset of upstream lego. Every supported certificate authority, challenge mode, credential field, and provider behavior has an explicit configuration and security contract.
Certificate authorities
Five current authority paths.
Account registration requirements differ by CA. AcmeMux uses typed fields for terms acknowledgement, email, External Account Binding, and supported fixed endpoints rather than accepting arbitrary server URLs.
ZeroSSL
Supported registration and External Account Binding flows with secrets kept in restrictive native credential files.
Google Trust Services
Supported ACME endpoint and EAB configuration through reviewed account fields.
SSL.com
Supported ACME account configuration with its required registration evidence.
GoDaddy ACME
The fixed supported GoDaddy ACME service. Arbitrary custom server URLs remain outside the current boundary.
DNS-01
Five provider integrations with explicit identity modes.
DNS credentials are write-only through the browser and remain in the selected native dotenv file. The broker receives only the reviewed variables needed for the chosen provider and authentication mode.
AWS
Amazon Route 53
Static or temporary credentials, a restricted shared profile, or an explicitly acknowledged EC2 instance role. An optional role assumption and hosted-zone override keep authority narrow.
Recommended scope: one hosted zone, TXT changes limited to required `_acme-challenge` names, plus change-status reads.
AZ
Azure DNS
Service principal, certificate, workload identity, managed identity, Azure CLI, OIDC, and Azure Pipelines modes across public, US Government, and China clouds.
Recommended scope: Reader on the exact zone and DNS Zone Contributor only where validation records are required.
CF
Cloudflare
Prefer one scoped token for DNS edit and zone read, or split those permissions into separate tokens. The legacy Global API Key path remains available with an explicit broad-authority warning.
Recommended scope: only the zones used by the native workspace.
DO
DigitalOcean
A write-only API token plus bounded upstream propagation and polling controls. Endpoint overrides require HTTPS except for isolated loopback testing.
Recommended scope: a token and account limited to the DNS zones AcmeMux must validate.
DD
DuckDNS
A write-only account token with provider-specific sequential challenge behavior and bounded propagation, polling, and HTTP timeouts.
DuckDNS shares one TXT record across a registered domain and its subdomains.
HTTP-01
Use an existing webroot or a constrained listener.
HTTP-01 is useful for ordinary hostnames when the validation service can reach port 80. Wildcard certificates require DNS-01.
Built-in listener
lego listens on an explicit address. The usual setup forwards only challenge traffic from a reverse proxy or host firewall to an unprivileged port.
Existing webroot
lego writes challenge files beneath an administrator-reviewed absolute directory already served by the website.
Low-port capability
If unavoidable, only the selected lego executable may carry the exact reviewed bind-service capability. AcmeMux itself remains unprivileged.
Exact executable compatibility
A provider compiled into lego is not automatically available.
The current AcmeMux release accepts only documented Linux amd64 executable digests and source identities. It validates the complete selected configuration against both upstream schema evidence and AcmeMux's curated semantics. New provider support requires field mapping, secret handling, native editing, execution, redaction, public documentation, and tests.
Request or sponsor provider compatibility