ACME

The client asks the certificate authority for a certificate covering a set of names.

The authority issues a challenge for each name, which the client must satisfy to prove control.

The client publishes whatever the challenge requires and tells the authority to verify it.

On success, the certificate is issued and the client installs it — normally reloading the server without an interruption.

The whole exchange runs unattended, typically on a timer that attempts renewal well before expiry.

HTTP validation serves a file at a well-known path over plain HTTP. It fails when a redirect to HTTPS is applied before the path is excluded, when a firewall blocks the authority, or when a CDN intercepts the path.

DNS validation publishes a record and proves control that way. It fails on propagation delay, on an API credential that expired, or on a provider that rate-limits record updates.

DNS validation is the only method that can issue a wildcard certificate, which is frequently what forces a switch to it.

HTTP validation is simpler and depends on the site being reachable, which makes it fragile during exactly the incidents when a certificate matters.

Both fail silently by default, because a renewal that does not happen produces no error anyone sees until the certificate expires.

Renewal runs on a timer with no human watching, so a failure is a log line on a server nobody reads.

The certificate remains valid for weeks afterwards, which means the problem is created long before it is noticed.

By the time browsers refuse the site, the cause is a configuration change made a month earlier that nobody connects to it.

Which is why monitoring the certificate's remaining validity is worth more than monitoring the renewal job: it catches every cause of failure, including the ones nobody anticipated.

The authority also sends expiry warnings to the registered address, which is only useful if that address reaches someone.

A CAA record in DNS names which certificate authorities may issue for a domain.

Authorities are required to check it, so it is an effective restriction rather than a statement of preference.

It prevents issuance by an authority you do not use, which narrows one route to a fraudulent certificate.

It also breaks your own renewal the moment you switch authorities and forget to update it, which is a self-inflicted version of the same failure.

The certificate really presented is retrieved, along with its issuer, its validity window and how long remains.

Whether it covers the hostname is checked, since a renewal that issued a certificate for the wrong set of names fails in a different way.

The CAA record is read, which is where an issuance restriction would be.

The renewal mechanism itself is not observable: what is visible is the certificate it produced, and how much time is left.