File-based certificate validation requires the issuer's challenge to be publicly available at the exact URL it specifies. Uploading a text file somewhere in the hosting account is insufficient if the requested hostname, path or response differs.
IN THIS ARTICLE
01 Place the challenge correctly
- Choose the HTTP validation method offered for the pending order. Download or copy the current filename, content and required URL.
- Identify the document root serving that exact hostname. An addon domain, subdomain and main domain can each use a different directory.
- Create the requested directories and upload the plain-text challenge without adding HTML, a byte-order mark or a second filename extension.
- Open the exact public URL from a separate connection. Confirm that it returns the expected text, rather than a login screen, redirect loop, security challenge or custom error page.
- Check each active web endpoint if the hostname uses multiple origins or a CDN. Ensure an old cache or IPv6 destination does not serve different content.
- Request validation. After issuance, retain or remove the challenge according to the issuer and automation requirements.
02 Example: retrieve the exact certificate-validation file
After uploading a file supplied by your certificate authority, test the exact URL it instructed you to publish. This illustrates a file-based validation path only. Replace both the path and token filename with the issuer's current instructions.
curl --silent --show-error --connect-timeout 10 --max-time 20 \
--dump-header - \
http://example.com/.well-known/pki-validation/ISSUED_FILENAME.txtRead the result: Confirm the HTTP status and exact response body. An application login page, branded 404 page, proxy challenge or generic index document can return content that looks successful in a browser but is not the expected validation token. Do not assume a redirect is accepted unless this issuer documents it.
Check the path on every address family or endpoint the authority may reach. Keep the application's normal security controls and use the narrowly documented validation location. Remove temporary validation files only when the issuer's workflow permits it, while preserving automated renewal requirements.
Common questions
Can HTTP validation cover a wildcard?
Use a supported DNS or other offered method for wildcard validation. DigiCert's HTTP demonstration validates exact requested hostnames and does not validate wildcard names.
May I redirect the challenge elsewhere?
Only within the redirect rules of the specific method. A redirect that works in your browser is not proof that the certificate authority will accept it. Serving the exact requested content directly is easier to verify.
What should I change if the firewall blocks the verifier?
Ask for a narrow exception for the validation path and supported validation traffic. Do not expose administrative directories or turn off the entire firewall for an ordinary challenge.