acme-dns on Ubuntu 24.04 LTS

acme-dns is an open source, deliberately limited DNS server with a small RESTful HTTP API, built for one job: answering the DNS-01 challenges that certificate authorities such as Let's Encrypt use to verify you control a domain. This cloudimg image runs acme-dns 2.0.2 from the official upstream release binary on Ubuntu 24.04 LTS as a hardened systemd service.

The security argument for acme-dns is containment. DNS-01 is the only ACME challenge type that can issue wildcard certificates and the only one that works for hosts with no public HTTP endpoint, but the usual way to automate it is to give an ACME client broad credentials for your entire DNS zone. acme-dns removes that exposure: you delegate one dedicated subdomain to it and point a CNAME at that subdomain. Each enrolled client receives its own randomly generated account and its own private subdomain, and the API will only ever let that account update that one subdomain, so a compromised client cannot touch the rest of your DNS.

acme-dns is a single statically linked binary with an embedded SQLite datastore, so there is no external database to run and no application server to tune. It answers authoritative DNS on port 53 over both UDP and TCP across all interfaces, because the certificate authority must be able to query it from the public internet, and serves its REST API over HTTPS on port 443. The systemd-resolved stub listener is disabled so acme-dns owns port 53 cleanly, while the operating system continues to resolve names normally. The service runs as a dedicated unprivileged account holding only the capability needed to bind low ports.

No default, shared or example credentials ship in the image, and acme-dns has no administrator account by design. On the first boot of your instance a one shot service mints a unique TLS keypair for the API, generates a challenge zone unique to that virtual machine, enrols an API account for you through the product's own registration endpoint, proves the whole path end to end by writing a TXT record through the authenticated API and reading it back over DNS, and writes the result to a root only file. A start time guard runs before every service start and refuses to run against any published example configuration.

acme-dns is distributed under the MIT License, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by the acme-dns project; acme-dns is a mark of its owner. cloudimg provides packaging, the secure by default configuration, per instance TLS and account automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.