ACME in depth · 18.8
HTTP-01
With HTTP-01, you prove control of a name with a file on the web server that the name points to (RFC 8555, section 8.3).
- The CA gives TLSPilot a token for every name of the order.
- TLSPilot publishes a file named after the token under
/.well-known/acme-challenge/: with the listener on the management host, in a local web root, or through WinRM or SSH on another web server. The file contains the key authorization, made of the token and the thumbprint of the account key. - The CA fetches
http://<name>/.well-known/acme-challenge/<token>on port 80 from several network perspectives and compares the content, see chapter Multi-perspective validation. - After the validation, TLSPilot removes the file again.
Settings: chapter Additional challenge types. Errors and solutions: chapter HTTP-01 and TLS-ALPN-01.
| Aspect | Details |
|---|---|
| Advantages | No DNS access is needed. Works with any web server; TLSPilot can place the file on Windows and Linux web servers. |
| Limits | Port 80 must be reachable from the internet; the CA always uses port 80. Redirects are allowed: Let’s Encrypt follows up to 10 redirects, only to http or https on port 80 or 443, and does not check the certificate of an https target. With several web servers behind one name, every server must deliver the file. |
| Wildcards | No. Use DNS-01. |
TLSPilot offers three ways to publish the HTTP-01 file: the listener on the management host, a local web root, or a web server reached through WinRM or SSH, see Figure HTTP-01 challenge with the publish modes.
