HTTP-01, DNS-01, and DNS Delegation: What's the Difference When Getting an SSL Certificate?

First-timers applying for an SSL certificate almost always get stuck at this step — picking a validation method. The UI shows HTTP-01, DNS-01, and sometimes DNS delegation. Three options, no explanation. Which one do you click?

What Does "Validation" Actually Mean?

Applying for an SSL certificate is essentially telling an organization called a CA (Certificate Authority): "This domain is mine — please issue me a certificate."

But the CA doesn't know you. It needs you to prove that you actually control the domain. Validation is how that works: the CA gives you a challenge to complete, and once you complete it, the CA trusts that you own the domain.

HTTP-01 and DNS-01 are two different types of challenges. DNS delegation is more of a helper strategy built on top of DNS-01. Let's go through each one.