HTTP-01 Challenge: How It Works and How to Complete It

HTTP-01 is the most common ACME challenge type for getting an SSL certificate. The CA verifies you control a domain by fetching a specific file from your web server over HTTP port 80. It’s simpler than DNS-01 but can’t be used for wildcard certificates.

How it works

1. Let’s Encrypt gives you a token (a random string)
2. You create a file at http://yourdomain.com/.well-known/acme-challenge/{token}
3. The file content is the key authorization — the token combined with your ACME account key thumbprint
4. Let’s Encrypt fetches this URL from the public internet
5. If the content matches, the challenge passes and your certificate is issued

With GetHTTPS, steps 1 and 3 are handled automatically — you just need to place the file on your server with the values shown on screen.

How to place the challenge file

Via SSH (Linux/Nginx/Apache)

# Create the directory
mkdir -p /var/www/html/.well-known/acme-challenge/

# Create the file with the exact values from GetHTTPS
echo "KEY_AUTHORIZATION_FROM_GETHTTPS" > /var/www/html/.well-known/acme-challenge/TOKEN_FROM_GETHTTPS

# Verify it's accessible
curl http://yourdomain.com/.well-known/acme-challenge/TOKEN_FROM_GETHTTPS

Via cPanel File Manager

1. Navigate to public_html
2. Create folder .well-known → inside it, create folder acme-challenge
3. Create a new file named with the token value
4. Paste the key authorization as the file content
5. Ensure permissions are 644 (readable by the web server)

Via FTP

1. Connect to your site root
2. Create .well-known/acme-challenge/ directory path
3. Upload a text file named with the token, containing the key authorization

Server configuration

Some web servers need configuration to serve files from .well-known:

Nginx

# Add to your server block if .well-known returns 404
location /.well-known/acme-challenge/ {
    root /var/www/html;
    allow all;
}

Apache

Apache usually serves .well-known by default. If not:

Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
<Directory "/var/www/html/.well-known/acme-challenge/">
    AllowOverride None
    Options None
    Require all granted
</Directory>

Node.js / Express

app.use('/.well-known/acme-challenge', express.static('challenges'));

Requirements

• The domain must resolve to a public IP address your server is on
• Port 80 must be open — Let’s Encrypt always validates over HTTP, not HTTPS
• The response must return HTTP 200 OK
• No cross-domain redirects — same-domain HTTP→HTTPS redirects are OK
• The file must be accessible without authentication (no Basic Auth, no login wall)

When to use HTTP-01

HTTP-01 vs DNS-01

Troubleshooting

Challenge file returns 404

• Check the exact path — must be /.well-known/acme-challenge/TOKEN with no extra slashes
• Check file permissions — chmod 644
• Nginx: Your config may block dotfiles. Add the location block shown above
• cPanel: File manager may hide .well-known — enable “Show Hidden Files”

Challenge fails despite file being accessible

• Check from outside your network: curl http://yourdomain.com/.well-known/acme-challenge/TOKEN from a different machine or use a web-based tool
• DNS may point to a different server — verify dig +short yourdomain.com returns your server’s IP
• Cloudflare proxy: Temporarily switch to DNS-only (gray cloud) during validation

Port 80 is blocked

Some hosts or firewalls block port 80. Options:

1. Open port 80 (even just temporarily for validation)
2. Switch to DNS-01 challenge — doesn’t need port 80
3. Ask your hosting provider to allow .well-known through their proxy

”too many requests” error

You’ve hit Let’s Encrypt’s rate limits. Wait and retry. GetHTTPS’s pre-check helps avoid wasted attempts by verifying the file is accessible before submitting.

Frequently asked questions

Can I delete the challenge file after getting the certificate?

Yes. The file is only needed during validation. Once your certificate is issued, delete the .well-known/acme-challenge/ directory and its contents. You’ll create new files when you renew.

Does the file need to be served over HTTPS?

No. Let’s Encrypt always validates HTTP-01 over plain HTTP (port 80), even if your site supports HTTPS. Same-domain HTTP→HTTPS redirects are followed, but the initial request is always HTTP.

Can I use HTTP-01 for multiple domains in one certificate?

Yes. Each domain in the certificate needs its own challenge file. If you’re getting a cert for example.com and www.example.com, you place two files — one token per domain. GetHTTPS handles them sequentially.

What’s the “pre-check” in GetHTTPS?

Before submitting to Let’s Encrypt, GetHTTPS verifies your challenge file is accessible from the public internet (via Google’s DNS-over-HTTPS). This catches configuration errors before they burn a rate limit attempt — a feature other browser-based tools don’t have.