liveBook · Manning

HTTP-01 challenge

As explained in Software Security for Developers

An HTTP challenge is a domain-control verification method that requires placing a specified file or response at an HTTP-accessible location.

An HTTP-01 challenge verifies domain control before a certificate authority issues a certificate. The requester submits a certificate signing request (CSR), receives a small challenge file, and makes it available through HTTP GET at a specified URL on the domain’s web server. section 9.1.3

Proving control of example.com

A requester sends a CSR to the CA over HTTPS. After receiving the challenge file, the requester places it at the required location on example.com. The CA retrieves the file; finding the expected response confirms domain control and allows certificate issuance. section 9.1.3

How Software Security for Developers covers it

How deep it goes
Explains the CSR, challenge-file deployment, HTTP retrieval, and comparison with email and DNS validation without detailing implementation code.
Examples
Uses a CSR, a challenge file hosted on a website, and a CA retrieval flow to demonstrate verification.
What it assumes
Assumes familiarity with domains, web servers, CSRs, and certificate authorities while defining domain validation from first principles.
What you can do after
Apply it via ACME by delivering a CSR and exposing the CA-provided challenge file at the required HTTP location.
How it connects
Connects domain validation with certificate signing requests, certificate authorities, ACME, HTTP GET, and DNS-01 challenges.
Cover of Software Security for Developers
liveBookmanning.com
Read Software Security for Developers on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.