HTTP file-based token
HTTP File-based Token (HTTP Practical Demonstration) proves domain or IP control by hosting a text file at a specific URL. The CA fetches that URL.
For IP-address names, this is the only DCV method all Certificate Authorities (CAs) offer. HTTP file DCV cannot be used for wildcard names (*.example.com). Each FQDN or IP on the order needs its own file.
On the request, choose HTTP File-based Token under Prove control over your domain.
Wildcards and MPIC. HTTP DCV is not valid for wildcard domains. The file must be reachable from the public internet on port 80 and/or 443 from multiple regions—not only from your office or one country. See SSL Domain Validation (DCV) Rules Have Changed .
1. Copy the file details
In the DCV Method panel, copy the file content (token). Note the filename:
| Brand | Filename | File body |
|---|---|---|
| DigiCert / GeoTrust | fileauth.txt |
A single token string |
| Sectigo / PositiveSSL | A long unique .txt name |
Two or three lines (token, sectigo.com, and a short value) |
The token is time-limited. Finish validation before it expires.
2. Host the file
Create the directory (note the leading dot):
/.well-known/pki-validation/
On Windows, create .well-known from a command prompt (mkdir .well-known) if Explorer will not.
Place the file so this URL works for each FQDN on the order:
http://example.com/.well-known/pki-validation/fileauth.txt
(Use the filename and host from your order. Repeat for www.example.com if that name is on the certificate—example.com does not cover www.)
Checks before you click Check:
- Open the URL in a browser. You should see the file contents, nothing else (no HTML error page).
- Only ports 80 and 443. Do not hide the file behind a login, VPN, or firewall allowlist.
- Avoid redirect chains. Multiple redirects often fail DCV. DigiCert/GeoTrust may try HTTP or HTTPS; Sectigo/PositiveSSL check the scheme the order is set to—not both.
- Cloudflare: a proxied (orange cloud) record can break the fetch. Use DNS-only or make sure the challenge URL returns the raw file.
3. Complete the check
Click Check (or Check validation) after the URL returns the token, or wait for automatic polling.
Check is optional. CertCommand and the CA retry DCV automatically. Click Check if you want an immediate lookup. You can change the DCV method on a pending domain until that name is approved.
Related topics
- Persistent DNS TXT — use DNS instead when HTTP is blocked or you have a wildcard
- Troubleshooting & FAQs
- Certificate Automation (ACME) — ACME HTTP-01 is a different file path (
/.well-known/acme-challenge/)
← Back to Domain Control Validation