==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 2026071501   EE v1.8.1
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version: Ubuntu 22.04.05
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MariaDB 1.7.2
- Web server (Apache or Nginx): NGINX
- Manage mail accounts with iRedAdmin-Pro? EE
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Huangbin,

iRedMail Enterprise Edition currently provides a convenient SSL Certificate interface that allows administrators to add multiple server and web hostnames, issue a Let’s Encrypt certificate, and have iRedMail manage deployment and renewal automatically.

Are there plans for adding support for ACME DNS-01 validation as an alternative to the current IP/web based validation (HTTP-01) method?

A possible implementation could include:

Selection of the ACME challenge method:
  >> HTTP-01
  >> DNS-01

Initial DNS provider support for Cloudflare / GoDaddy

Secure storage of a restricted Cloudflare / GoDaddy API token

DNS zone and credential validation before certificate issuance
Continued automatic certificate installation and renewal through the existing Enterprise Edition workflow

Support for wildcard names, such as *.domain.tld

A provider or hook interface that could later support additional DNS services

The current Enterprise Edition certificate management works well. DNS-01 support would extend that functionality for environments where:

  >> Port 80 is unavailable or intentionally restricted
  >> A hostname cannot point directly to the mail server during validation
  >> Wildcard certificates are required
  >> Multiple DNS zones are managed centrally
  >> Administrators want certificate validation to remain independent of web path

Ideally, the Enterprise Edition would remain responsible for the complete certificate lifecycle, including issuance, renewal, installation, service reloads, status reporting, and expiration warnings. This would avoid competing external ACME clients or administrator written deployment scripts modifying certificates managed by iRedMail.

For Cloudflare, the integration could use a restricted API token limited to DNS record editing and zone access for the selected zones.

Would be great if considered