Technical Notes · SSL/TLS · ACME Protocol · Root Access VPS
ACME HTTP-01 Challenge Notes
Working notes on the ACME HTTP-01 challenge — the simplest way to prove domain control and issue a free Let's Encrypt certificate for a single hostname on a Hoststack Linux VPS or shared hosting account.
See Linux VPS PlansHow HTTP-01 Validation Works
The default challenge type used by Certbot and most ACME clients for issuing certificates on web servers.
Well-Known File Proof
The CA requests a specific file at http://yourdomain/.well-known/acme-challenge/
Port 80 Required
Your server must answer on port 80 (even if you redirect everything else to HTTPS) for validation to succeed — firewalls or DDoS filtering that block port 80 will fail the challenge.
Single Hostname Only
Each HTTP-01 validation proves control of exactly one hostname — you cannot issue a wildcard cert this way, only individual subdomains (each validated separately).
Fast & Simple
No DNS provider API needed. Certbot's webroot or standalone plugin handles the whole flow automatically in most default Apache/Nginx setups.
Root Access on VPS
Hoststack Linux VPS plans give you root SSH to configure Nginx/Apache, install Certbot, and set the correct webroot path yourself.
Auto-Renewal via Cron
Certbot installs a systemd timer or cron job by default that renews certificates automatically before the 90-day expiry.
How HTTP-01 Differs From DNS-01
HTTP-01 is the default, simplest ACME challenge. The certificate authority gives your ACME client a token; the client places a file containing that token at a predictable URL under /.well-known/acme-challenge/ on your web server; the CA fetches that URL over plain HTTP to confirm you control the server answering for that domain.
The tradeoff is that HTTP-01 requires the CA to reach port 80 on your public IP at validation time, and it can only validate one hostname per request — no wildcards. For a single domain or a handful of subdomains on a standard LEMP/LAMP stack, it's usually the easier and faster option. See our DNS-01 challenge notes if you need wildcard coverage instead.
Common failure modes
The most frequent causes of HTTP-01 failures we see reported by VPS customers: a firewall or security group blocking inbound port 80, an Nginx server block that redirects all HTTP traffic to HTTPS before Certbot's temporary file can be served, or a reverse proxy/CDN in front of the origin that doesn't pass through the .well-known path.
Running Certbot on a Hoststack VPS
On an unmanaged Hoststack Linux VPS (KVM, root access, Ubuntu/Debian/CentOS from ₹399/mo), the standard flow is straightforward:
- Install Certbot with the correct plugin for your web server (python3-certbot-nginx or python3-certbot-apache).
- Run certbot --nginx (or --apache) and let it detect your server blocks/vhosts automatically, or use certonly --webroot for more control.
- Make sure any temporary HTTP→HTTPS redirect exempts the /.well-known/acme-challenge/ path during first issuance.
- Verify the systemd timer (systemctl list-timers | grep certbot) or cron entry Certbot installs for renewal.
- If you run DDoS protection or a proxy in front of the VPS, confirm the challenge path isn't being filtered before it reaches the origin.
If you're on Hoststack shared hosting with cPanel, DirectAdmin, or Plesk instead of a VPS, none of this manual work is needed — AutoSSL / Let's Encrypt integration in the panel issues and renews HTTP-01-validated certificates for you automatically at no extra cost.
FAQ
ACME HTTP-01 questions
Need a VPS with full root access for SSL automation?
Hoststack Linux VPS from ₹399/mo — KVM, root SSH, Ubuntu/Debian/CentOS, Mumbai & Delhi data centers.
See Linux VPS Plans