Change an existing HTTP Proxy from using HTTP-01 to DNS-01 Challenge for Let's Encrypt Certs.

[fifolifo]

I have a few HTTP Proxy rules and initially out of convenience, I configured all of them to use HTTP-01 challenge to get their certificate from Let's Encrypt.

Today, I generated the appropriate API tokens to use DNS-01 challenge and when I got on the admin portal to change each HTTP Proxy from HTTP-01 to DNS-01 challenge, I didn't see where this change could be made. Under Reverse Proxy>HTTP Proxy>Edit Proxy Rule>TLS/SSL, there is only the options to either "Get Certificate", which just renews the certificate using HTTP-01 or the option to "Generate Self-Signed Certificate."

How can I make this change to the Challenge type without having to recreate the HTTP Proxy rule?

[tobychui]

I dont think TLS certificate management is related to HTTP Proxy rule. Those two should be separated system. I guess what you need to do is just delete the certificate from the TLS certificate interface and regenerate it using DNS challenge and it will just works?

Maybe our maintainer for DNS-01 challenge @zen8841 will have more idea on how it works under the hood.

[fifolifo]

That's a great suggestion and I just tried it out. I deleted the certificate in the TLS interface and then went to the associated HTTP Proxy rule and clicked on Get Certificate. Unfortunately, there must be a config somewhere with the previous setting still as it just got a certificate using HTTP-01 again. I wasn't shown the setup screen that is shown when first setting up Get Certificate, which was I was expecting this time when selecting Get Certificate.

[fifolifo]

I just tried that route and selected "Open ACME Tool" and from the side menu selected DNS Challenge and then input the relevant fields again. Unfortunately, I'm still getting the same error as the previous error when requesting a cert though.

I did notice something that looks off though. In Security>TLS/SSL Certificates. The subdomain that I'm requesting a cert for isn't listed here as I have deleted it. However under Security>ACME Client, the "Advanced Renew Policy" section still shows that subdomain under both the "Domain Name" and "Match Rule" column. Since the subdomain no longer has a certificate since I manually deleted it. It doesn't seem like it should be still listed in the "Advanced Renew Policy" section. So maybe, it's somehow ignoring my DNS-Challenge selection with Token inputs and actually just using HTTP-01 after all as I thought it was strange that this was showing up in the error log "https://aaaa.bbb.net/.well-known/acme-challenge/" because I thought that ".well-known/acme-challenge" path was specific to HTTP-01 Challenges only.

I'll sleep on it and look into a bit more tomorrow. Thanks for all your help thus far. I really appreciate it.

[fifolifo]

@zen8841
Yes. I'm using the splitting tokens methods. I have the CF_ZONE_API_TOKEN, which has Zone/Zone/Read and CF_DNS_API_TOKEN, which has Zone/DNS/Edit to a specific zone only.

When creating the API Tokens, Cloudflare provides a curl command that can be run to verify that the tokens are working properly. I ran the provided curl command on a linux vm here and the test for both tokens were successful.

[zen8841]

@fifolifo
I think you should also delete the old certificate renew policy in the ACME client.

[fifolifo]

Leading with good news, I wanted to share that I was able to use DNS-Challenge to get a cert from Let's Encrypt.

Here is some additional information on it with some oddities that may or may not be intended.

Before heading to bed, I disabled the HTTP Proxy rule that I was using for testing. When I got back on the Admin Portal and re-enabled that rule, I noticed that subdomain wasn't listed now in Security>ACME Client, the "Advanced Renew Policy" section as I reported earlier. Perhaps disabling the rule and re-enabling it cleaned this up?

I accessed Security>ACME Client>"Open ACME Tool" and from the side menu selected DNS Challenge and then input the relevant fields again for Cloudflare DNS Credentials (for me, these were AuthEmail, AuthToken, and ZoneToken) and this time it went through without error. Here are the relevant log entries:

[2026-08-09 09:05:52.246970] [ACME] [system:error] Could not extract SANs from PEM, using domainPara only: open ./conf/certs/aaa.bbb.net.pem: no such file or directory
[2026-08-09 09:05:52.247048] [ACME] [system:info] Obtaining certificate for: aaa.bbb.net
[2026-08-09 09:05:52.247162] [ACME] [system:info] Using https://acme-v02.api.letsencrypt.org/directory for CA Directory URL
[2026-08-09 09:05:52.247215] [ACME] [system:info] Reusing existing ACME account for https://acme-v02.api.letsencrypt.org/directory

I then checked the HTTP Proxy rule and verified that the hostname was resolving to this new certificate.

The lone oddity that I have now is that under Security>TLS / SSL Certificates, the "DNS Challenge" column for this subdomain has a red "x", just like all of the other subdomains listed here that have been configured to use HTTP-01 Challenge. I assume that this is not intended and that the the "DNS Challenge" column should actually be showing something else for this specific subdomain, like a green checkmark or something like that.

Thanks for all of guidance and information. I appreciate it.

In case it's helpful, I wanted to add that I'm running the release version of 3.3.4 and that Zoraxy was installed as a Proxmox LXC using the script provided at https://community-scripts.org/scripts/zoraxy

[zen8841]

It's a bit strange; the peculiar behavior might be due to incomplete deletion.
However, I don't have the environment to reproduce it, and it doesn't seem to be a serious bug.

[fifolifo]

If it's helpful, please let me know if there are any tests that you would like me to perform on my system. I'm happy to do it.