SimpleACME DNS-01 setup
Read-only DNS-01 setup guides and configuration templates for Traefik, win-acme, Certbot and custom hooks.
Hosted MCP Server
npx add-mcp 'https://simpleacme.com/mcp'Installs into Claude Code, Codex, Cursor and more
Documentation
One endpoint.Familiar tools.
Public integration guidance for Traefik, win-acme and Certbot. A read-only MCP server can help a compatible assistant prepare configurations without receiving your credentials.
Traefik DNS-01 without a DNS-provider API token
Keep certificate automation in your reverse proxy. Delegate the challenge with one CNAME and configure the ACME-DNS provider with an existing SimpleACME registration.
Windows DNS-01 with win-acme and SimpleACME
Validate Windows service names without a public HTTP challenge endpoint. Use existing SimpleACME credentials in a reviewed PowerShell DNS hook.
Certbot DNS-01 with a permanent CNAME
Use Linux or Docker authentication hooks to publish the DNS proof through SimpleACME. Keep your certificate keys and deployment under your control.
Connect the public MCP
Use this URL in a client that supports remote Streamable HTTP MCP servers. Connection is opt-in. The server supports protocol 2025-11-25 with JSON responses; it provides guidance and templates, not account access or DNS mutations.
https://simpleacme.com/mcp
Available tools
get_service_info— service facts and boundaries.get_setup_guide— client-specific steps.generate_update_script— Bash or PowerShell starter templates using environment placeholders.build_client_config— example configuration for a public hostname.
Review generated files locally. Do not send passwords, certificate keys or customer account data as MCP arguments. Complete subscriber guides and deployment examples remain in the paid setup library. For a ready-to-copy prompt that asks about your service and uses these tools, open Set up any service with AI help.
The authenticated update API
POST https://simpleacme.com/update accepts JSON with subdomain and txt, authenticated using X-Api-User and X-Api-Key. Use the assigned subdomain and a 43-character ACME DNS authorization value. Updates require current paid access. Wait for public TXT visibility before validation.
{"subdomain":"YOUR_ASSIGNED_SUBDOMAIN","txt":"ACME_DNS_AUTHORIZATION_VALUE"}
Registrations are created through the account and payment workflow; anonymous /register is blocked. The API receives a TXT value, not a certificate request, so the activity timeline does not confirm issuance.