How to: ACME Challenges
Reproxy supports two types of ACME challenges for SSL certificate validation:

1. **HTTP-01 Challenge** (default): Validates domain ownership by serving a token at a specific HTTP URL. Requires port 80 to be publicly accessible.

2. **DNS-01 Challenge**: Validates domain ownership by creating DNS TXT records. This method:
   - Does not require port 80 to be accessible
   - Works with wildcard certificates
   - Requires a supported DNS provider configuration

#### Challenge Selection

Reproxy automatically determines which challenge method to use based on your configuration:

- **HTTP-01** (default): Used when no DNS provider is configured
- **DNS-01**: Used when a DNS provider is configured

You don't need to explicitly select a challenge type - just configure a DNS provider if you want to use DNS-01 challenges.

#### Currently Supported DNS Providers

Reproxy currently includes support for the following DNS providers:

- **Cloudflare**: `--ssl.dns.type=cloudflare --ssl.dns.cloudflare.api-token=TOKEN`
- **Route53 (AWS)**: `--ssl.dns.type=route53 --ssl.dns.route53.region=REGION --ssl.dns.route53.hosted-zone-id=ID`
- **Gandi**: `--ssl.dns.type=gandi --ssl.dns.gandi.bearer-token=TOKEN`
- **DigitalOcean**: `--ssl.dns.type=digitalocean --ssl.dns.digitalocean.api-token=TOKEN`
- **Hetzner**: `--ssl.dns.type=hetzner --ssl.dns.hetzner.api-token=TOKEN`
- **Linode**: `--ssl.dns.type=linode --ssl.dns.linode.api-token=TOKEN`
- **GoDaddy**: `--ssl.dns.type=godaddy --ssl.dns.godaddy.api-token=TOKEN`
- **Namecheap**: `--ssl.dns.type=namecheap --ssl.dns.namecheap.api-key=KEY --ssl.dns.namecheap.user=USER`
- **Scaleway**: `--ssl.dns.type=scaleway --ssl.dns.scaleway.secret-key=KEY --ssl.dns.scaleway.organization-id=ID`
- **Porkbun**: `--ssl.dns.type=porkbun --ssl.dns.porkbun.api-key=KEY --ssl.dns.porkbun.api-secret-key=SECRET`
- **DNSimple**: `--ssl.dns.type=dnsimple --ssl.dns.dnsimple.api-access-token=TOKEN --ssl.dns.dnsimple.account-id=ID`
- **DuckDNS**: `--ssl.dns.type=duckdns --ssl.dns.duckdns.api-token=TOKEN`

Example with Cloudflare as DNS provider:
```
export CLOUDFLARE_API_TOKEN=your_api_token
reproxy --ssl.type=auto --ssl.acme-email=admin@example.com --ssl.fqdn=example.com
```

The DNS-01 challenge is especially useful when:
- Your server doesn't have port 80 exposed publicly
- You need wildcard certificates (e.g., *.example.com)
- You're behind restrictive firewalls