How does Let's Encrypt verify domain ownership before issuing a certificate?
sobes.tech AI
Answer from AI
Let's Encrypt verifies domain ownership through a process called ACME (Automatic Certificate Management Environment). The main verification methods are:
-
HTTP-01 challenge: the Let's Encrypt server requests a special file with a unique token, which must be placed on the web server at a specific path (e.g., http://example.com/.well-known/acme-challenge/token). If the file is accessible and contains the correct token, ownership is confirmed.
-
DNS-01 challenge: the domain owner creates a special TXT record in DNS with a unique value. Let's Encrypt checks for this record to confirm control over the domain.
-
TLS-ALPN-01 challenge: a special TLS certificate is used, which the server must present during a TLS connection on a specific port.
After successfully passing one of these verifications, Let's Encrypt issues a certificate confirming domain ownership.