diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
index 4e6292142..4673272f2 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogCertificate.xml
@@ -70,4 +70,32 @@
         <type>text</type>
         <help><![CDATA[Specifies the days to renew the cert. The max value is 60 days.]]></help>
     </field>
+    <field>
+        <id>certificate.aliasmode</id>
+        <label>DNS Alias Mode</label>
+        <type>dropdown</type>
+        <help><![CDATA[Configure DNS alias mode to validate the certificate.]]></help>
+    </field>
+    <field>
+        <label>DNS Alias Mode</label>
+        <type>header</type>
+        <style>aliasmode aliasmode_domain</style>
+    </field>
+    <field>
+        <id>certificate.domainalias</id>
+        <label>Domain Alias</label>
+        <type>text</type>
+        <help><![CDATA[When setting DNS alias mode to "Domain Alias", enter the domain name that should be used for certificate validation. Please refer to the <a href="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode">acme.sh documentation</a> for further information.]]></help>
+    </field>
+    <field>
+        <label>DNS Alias Mode</label>
+        <type>header</type>
+        <style>aliasmode aliasmode_challenge</style>
+    </field>
+    <field>
+        <id>certificate.challengealias</id>
+        <label>Challenge Alias</label>
+        <type>text</type>
+        <help><![CDATA[When setting DNS alias mode to "Challenge Alias", enter the domain name that should be used for certificate validation. Please refer to the <a href="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode">acme.sh documentation</a> for further information.]]></help>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 5733ea91d..1afa9d4f8 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -243,6 +243,22 @@
                     <MaximumValue>60</MaximumValue>
                     <default>60</default>
                 </renewInterval>
+                <aliasmode type="OptionField">
+                    <Required>Y</Required>
+                    <default>none</default>
+                    <OptionValues>
+                        <none>Not using DNS alias mode</none>
+                        <automatic>Automatic Mode (uses DNS lookups)</automatic>
+                        <domain>Domain alias mode</domain>
+                        <challenge>Challenge alias mode</challenge>
+                    </OptionValues>
+                </aliasmode>
+                <domainalias type="TextField">
+                    <Required>N</Required>
+                </domainalias>
+                <challengealias type="TextField">
+                    <Required>N</Required>
+                </challengealias>
                 <!-- hidden field; ID of the certificate in Cert Manager -->
                 <certRefId type="TextField">
                     <Required>N</Required>
diff --git a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt
index 0c7c34e1a..c2e206bd6 100644
--- a/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt
+++ b/security/acme-client/src/opnsense/mvc/app/views/OPNsense/AcmeClient/certificates.volt
@@ -379,6 +379,16 @@ POSSIBILITY OF SUCH DAMAGE.
 
         });
 
+        // Hide options that are irrelevant in this context.
+        $('#DialogCertificate').on('shown.bs.modal', function (e) {
+            $("#certificate\\.aliasmode").change(function(){
+                $(".aliasmode").hide();
+                $(".aliasmode_"+$(this).val()).show();
+            });
+            $("#certificate\\.aliasmode").change();
+        })
+
+
         /***********************************************************************
          * Commands
          **********************************************************************/
diff --git a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php
index d8c96b5df..0524053e8 100755
--- a/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php
+++ b/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient/certhelper.php
@@ -893,24 +893,49 @@ function run_acme_validation($certObj, $valObj, $acctObj)
     // Prepare altNames
     $altnames = "";
 
-    //Find Alias for main domain
+    // Main domain: Use DNS alias mode for domain validation?
     // https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
-    $name = "_acme-challenge." . ltrim((string)$certObj->name, '*.');
-    if ($dst = dns_get_record($name, DNS_CNAME )) {
-        $altnames .= "--domain-alias " .$dst[0]['target'] . " ";
+    if ($val_method == 'dns01') {
+        switch ((string)$valObj->aliasmode) {
+            case 'automatic':
+                $name = "_acme-challenge." . ltrim((string)$certObj->name, '*.');
+                if ($dst = dns_get_record($name, DNS_CNAME )) {
+                    $altnames .= "--domain-alias " . $dst[0]['target'] . " ";
+                }
+                break;
+            case 'domain':
+                $altnames .= "--domain-alias " . (string)$certObj->domainalias . " ";
+                break;
+            case 'challenge':
+                $altnames .= "--challenge-alias " . (string)$certObj->challengealias . " ";
+                break;
+        }
     }
 
     if (!empty((string)$certObj->altNames)) {
         $_altnames = explode(",", (string)$certObj->altNames);
         foreach (explode(",", (string)$certObj->altNames) as $altname) {
             $altnames .= "--domain ${altname} ";
-            //Find Alias
-            // https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
-            $name="_acme-challenge." . ltrim($altname, '*.');
 
-            if ($dst = dns_get_record($name, DNS_CNAME )) {
-                $altnames .= "--domain-alias " .$dst[0]['target'] . " ";
+            // altNames: Use DNS alias mode for domain validation?
+            // https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
+            if ($val_method == 'dns01') {
+                switch ((string)$valObj->aliasmode) {
+                    case 'automatic':
+                        $name = "_acme-challenge." . ltrim($altname, '*.');
+                        if ($dst = dns_get_record($name, DNS_CNAME )) {
+                            $altnames .= "--domain-alias " . $dst[0]['target'] . " ";
+                        }
+                        break;
+                    case 'domain':
+                        $altnames .= "--domain-alias " . (string)$certObj->domainalias . " ";
+                        break;
+                    case 'challenge':
+                        $altnames .= "--challenge-alias " . (string)$certObj->challengealias . " ";
+                        break;
+                }
             }
+
         }
     }