# What Is HTTP-01 Challenge (HTTP-01)? Definition and Examples

> HTTP-01 is an ACME challenge in which the client proves domain control by serving a CA-specified token over plain HTTP on port 80.

Source: https://ssl.sh/glossary/http-01/
Last updated: 2026-11-10

HTTP-01 is the most widely used [ACME](https://ssl.sh/glossary/acme/) challenge type. The CA gives the client a token; the client publishes the key authorization (the token plus a thumbprint of the account key) at http://example.com/.well-known/acme-challenge/TOKEN, and the CA fetches it, from several network perspectives under [MPIC](https://ssl.sh/glossary/mpic/). Validation always starts on port 80, and the CA may follow redirects, including to HTTPS on port 443.

## Why it matters
HTTP-01 needs no DNS access, so any web server can use it, and clients such as Certbot can configure nginx or Apache automatically. Its limits matter just as much: it cannot validate [wildcard certificates](https://ssl.sh/glossary/wildcard-certificate/), port 80 must be reachable from the internet, and every server behind a load balancer must serve the same token. When those conditions cannot be met, use [DNS-01](https://ssl.sh/glossary/dns-01/) instead.

## Example
An nginx server block that serves challenges while redirecting everything else to HTTPS:

```nginx
server {
    listen 80;
    server_name example.com;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
        default_type "text/plain";
    }

    location / {
        return 301 https://$host$request_uri;
    }
}
```

Test the path before requesting a certificate:

```bash
mkdir -p /var/www/html/.well-known/acme-challenge
echo ok > /var/www/html/.well-known/acme-challenge/test
curl -i http://example.com/.well-known/acme-challenge/test
```

## Common misconceptions
- **Redirecting HTTP to HTTPS breaks HTTP-01.** Redirects are followed; what breaks validation is closing port 80 or blocking it at a firewall.
- **Allowing only the CA's IP addresses is enough.** Validation comes from multiple, changing network locations.
- **HTTP-01 works for *.example.com.** Wildcard names require DNS-01.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [TLS-ALPN-01](https://ssl.sh/zh/glossary/tls-alpn-01/): TLS-ALPN-01 是一种 ACME 验证方式，服务器在 443 端口针对 acme-tls/1 协议出示一张特殊证书来证明域名控制权。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [反向代理](https://ssl.sh/zh/glossary/reverse-proxy/): 反向代理是代表后端服务器接收客户端连接、再把请求转发给后端的服务器，通常同时承担 TLS 终止。