Lets Encrypt Wildcard Certificate DNS-PERSIST-01

Question
1

I’m trying to create a new wildcard certificate from Lets Encrypt using DNS-PERSIST-01 verification, but it’s saying;
2026-08-24 09:53:31.377 +01:00 [INF] ---- Beginning Request [.clarketransport.net] ----
2026-08-24 09:53:31.377 +01:00 [INF] Certify/7.1.1.0 (Microsoft Windows 10.0.20348; Microsoft Windows NT 10.0.20348.0)
2026-08-24 09:53:31.378 +01:00 [INF] Beginning certificate request process: .clarketransport.net using ACME provider Anvil
2026-08-24 09:53:31.378 +01:00 [INF] The selected Certificate Authority is: Let’s Encrypt
2026-08-24 09:53:31.378 +01:00 [INF] Requested identifiers to include on certificate: .clarketransport.net;clarketransport.net
2026-08-24 09:53:32.536 +01:00 [INF] Created ACME Order: [Link]/acme/order//548753350101
2026-08-24 09:53:34.300 +01:00 [INF] Got dns-01 challenge [Link]/acme/chall//765773962641/xkY-6g
2026-08-24 09:53:35.944 +01:00 [INF] Got http-01 challenge [Link]/acme/chall//765773962661/TV_xTw
2026-08-24 09:53:36.597 +01:00 [INF] Got dns-01 challenge [Link]/acme/chall/***/765773962661/FIPZug
2026-08-24 09:53:37.405 +01:00 [INF] Preparing automated challenge responses for: *.clarketransport.net
2026-08-24 09:53:37.405 +01:00 [INF] Preparing automated challenge responses for: clarketransport.net
2026-08-24 09:53:37.405 +01:00 [INF] Resuming certificate request using CA: Let’s Encrypt
2026-08-24 09:53:37.405 +01:00 [INF] Attempting challenge response validation for: *.clarketransport.net
2026-08-24 09:53:37.405 +01:00 [INF] [Progress] Checking automated challenge response for: *.clarketransport.net
2026-08-24 09:53:37.405 +01:00 [INF] Submitting challenge for validation: *.clarketransport.net
2026-08-24 09:53:37.405 +01:00 [ERR] [Progress] Challenge could not be submitted. No matching attempted challenge. Check the CA supports the configured challenge type.
2026-08-24 09:53:37.405 +01:00 [INF] Attempting challenge response validation for: clarketransport.net
2026-08-24 09:53:37.405 +01:00 [INF] [Progress] Checking automated challenge response for: clarketransport.net
2026-08-24 09:53:37.406 +01:00 [INF] Submitting challenge for validation: clarketransport.net
2026-08-24 09:53:37.406 +01:00 [ERR] [Progress] Challenge could not be submitted. No matching attempted challenge. Check the CA supports the configured challenge type.
2026-08-24 09:53:37.406 +01:00 [ERR] Validation of the required challenges did not complete successfully. Challenge could not be submitted. No matching attempted challenge. Check the CA supports the configured challenge type.

Someone advise if I’ve missed a step? Or am I too early still and it’s not actually supported? LE’s blog says Q2 2026 for deployment and I can’t find any definitive information on whether it’s live or not.

Thanks

2

Hi,

We have draft support for dns-persist-01 but Let’s Encrypt do not implement it except in their test/staging environment.

We’ve heard that they are waiting for some changes to the spec around the content of the TXT record itself so it’s more directly tied to the ACME account key etc.

I believe digicert may have draft support for it in their services but I’ve not heard of anyone using it.

So basically yes, it’s a work in progress, and it should work when it arrives, worst case you may need to specify the TXT record differently to what we already know about, and I believe Let’s Encrypt don’t want to allow wildcard subdomains on one record, which is a shame (it seems to me like that should be the choice of the domain owner).