Skip to content

Commit 935eb03

Browse files
Note pre-validation possible with HTTP and fix CA capitalization
1 parent 33911b5 commit 935eb03

File tree

2 files changed

+5
-7
lines changed

2 files changed

+5
-7
lines changed

src/content/docs/ssl/edge-certificates/changing-dcv-method/methods/http.mdx

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,11 @@ If you encounter issues with HTTP DCV, refer to the [troubleshooting guide](/ssl
2525

2626
## Limitations
2727

28-
HTTP DCV is only available for [proxied domains](/dns/manage-dns-records/reference/proxied-dns-records/).
28+
HTTP DCV is only available for [proxied domains](/dns/manage-dns-records/reference/proxied-dns-records/). It is possible to manually add the DCV token to the `.well-known/pki-validation/` directory on your origin web server to pre-validate your certificates.
2929

30-
HTTP DCV validation also does not work for wildcard certificates.
30+
HTTP DCV validation does not work for wildcard certificates. If you want to use wildcard certificates, use [TXT validation](/ssl/edge-certificates/changing-dcv-method/methods/txt/).
3131

32-
If you want to use wildcard certificates or pre-validate your certificate — either to avoid downtime or prevent any issuance errors — use [TXT validation](/ssl/edge-certificates/changing-dcv-method/methods/txt/).
33-
34-
Based on your chosen Certificate Authority, you may also not be able to use HTTP verification with [advanced certificates](/ssl/edge-certificates/advanced-certificate-manager/).
32+
Based on your chosen certificate authority (CA), you may also not be able to use HTTP verification with [advanced certificates](/ssl/edge-certificates/advanced-certificate-manager/).
3533

3634
## Setup
3735

@@ -47,7 +45,7 @@ To make sure your domain does not accidentally block HTTP DCV, review your Cloud
4745

4846
### Complete DCV
4947

50-
Your HTTP token will be available for the Certificate Authority as soon as you finish your [partial domain setup](/dns/zone-setups/partial-setup/setup/#3-add-dns-records).
48+
Your HTTP token will be available for the certificate authority as soon as you finish your [partial domain setup](/dns/zone-setups/partial-setup/setup/#3-add-dns-records).
5149

5250
This means that you need to add a CNAME record to Cloudflare in your authoritative DNS and create [proxied DNS records](/dns/manage-dns-records/reference/proxied-dns-records/) for your hostname within Cloudflare.
5351

src/content/partials/ssl/cname-cert-verification.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@
33

44
---
55

6-
Cloudflare contacts one of our Certificate Authority providers and asks them to issue certificates for the specified hostname. The CA will then inform Cloudflare that we need to “demonstrate control” of this hostname by returning a `$DCV_TOKEN` at a specified `$DCV_FILENAME`; both the token and the filename are randomly generated by the CA and not known to Cloudflare ahead of time.
6+
Cloudflare contacts one of our certificate authority (CA) providers and asks them to issue certificates for the specified hostname. The CA will then inform Cloudflare that we need to “demonstrate control” of this hostname by returning a `$DCV_TOKEN` at a specified `$DCV_FILENAME`; both the token and the filename are randomly generated by the CA and not known to Cloudflare ahead of time.
77

88
For example, if you create a new custom hostname for `site.example.com`, the CA might ask us to return the value `ca3-38734555d85e4421beb4a3e6d1645fe6` for a request to `http://site.example.com/.well-known/pki-validation/ca3-39f423f095be4983922ca0365308612d.txt"`. As soon as we receive that value from the CA we make it accessible at our edge and ask the CA to confirm it’s there so that they can complete validation and the certificate order.

0 commit comments

Comments
 (0)