ACME Challenge (HTTP-01 and DNS-01)

An ACME challenge is the proof-of-control step in automated certificate issuance. The CA gives the client a token, and the client must show it can publish that token where only the domain's controller could. The two most common types are HTTP-01 and DNS-01.

Why it matters

Most failed renewals are failed challenges. With HTTP-01, the CA fetches a file from http://example.com/.well-known/acme-challenge/<token> on port 80, so a firewall, a redirect to a different host or an application catching all routes can break it. HTTP-01 cannot issue wildcard certificates. DNS-01 requires creating a _acme-challenge TXT record, works for wildcards and for servers not reachable from the internet, but needs DNS API credentials, which should be tightly scoped.

Example

A DNS-01 challenge expects a record like:

_acme-challenge.example.com. 300 IN TXT "gfj9Xq...Rg85nM"

You can confirm it with dig +short TXT _acme-challenge.example.com. For HTTP-01, test with curl -i http://example.com/.well-known/acme-challenge/test.

Common mistakes

Blocking port 80 after moving to HTTPS only.
Forcing a redirect of the challenge path to an authentication page.
Leaving a stale _acme-challenge CNAME or TXT pointing at an old provider.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.