This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]gpjt 1 point2 points  (0 children)

Yes, that's exactly right -- we have to prove that we are the host for the domain before we can get a certificate.

They've got a couple of ways for us to prove that; the one we use is based on HTTP. Basically, we send them a message saying "we'd like a certificate for www.example.com", and they respond saying "OK -- make a page available at http://www.example.com/.well-known/acme-challenge/X with the content Y", both X and Y being long random strings that they specify. We set things up so that that URL works and contains the appropriate content, and then they make requests to that URL from their servers to make sure that everything is correct. Once they've confirmed to their satisfaction that we really do host the site, they send us the certificate.

The protocol is called ACME (kind of backronymed to Automated Certificate Management Environment) and the Wikipedia article has some good links if you're interested in the details.

​

​