中文

Glossary

HTTP-01 Challenge (HTTP-01)

Last verified

Definition

HTTP-01 is an ACME challenge in which the client proves domain control by serving a CA-specified token over plain HTTP on port 80.

HTTP-01 is the most widely used ACME challenge type. The CA gives the client a token; the client publishes the key authorization (the token plus a thumbprint of the account key) at http://example.com/.well-known/acme-challenge/TOKEN, and the CA fetches it, from several network perspectives under MPIC. Validation always starts on port 80, and the CA may follow redirects, including to HTTPS on port 443.

Why it matters

HTTP-01 needs no DNS access, so any web server can use it, and clients such as Certbot can configure nginx or Apache automatically. Its limits matter just as much: it cannot validate wildcard certificates, port 80 must be reachable from the internet, and every server behind a load balancer must serve the same token. When those conditions cannot be met, use DNS-01 instead.

Example

An nginx server block that serves challenges while redirecting everything else to HTTPS:

server {
    listen 80;
    server_name example.com;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        default_type "text/plain";
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

Test the path before requesting a certificate:

mkdir -p /var/www/html/.well-known/acme-challenge
echo ok > /var/www/html/.well-known/acme-challenge/test
curl -i http://example.com/.well-known/acme-challenge/test

Common misconceptions

  • Redirecting HTTP to HTTPS breaks HTTP-01. Redirects are followed; what breaks validation is closing port 80 or blocking it at a firewall.
  • Allowing only the CA's IP addresses is enough. Validation comes from multiple, changing network locations.
  • *HTTP-01 works for .example.com. Wildcard names require DNS-01.

See also