Method 3: File Verification

Applicable Certificate Types

• DV certificate: When you apply for a DV certificate, bind a single domain name and select file verification.
• OV certificate: When you apply for an OV certificate, bind an IP address.

Prerequisites

Port 80 or 443 is enabled on the server.

CAs send authentication requests only to port 80 or 443.

Notes and Constraints

• If you apply for an international SSL certificate from a CA, such as DigiCert or GlobalSign, and the firewall or security group has an access whitelist, allow communication with the IP address range of the CA. In this way, the CA can access the server for verification.
• If your domain resolves to a server in the Chinese mainland, ICP filing is required. Otherwise, your website cannot be accessed.

Step 1: Obtaining Verification Information

1. Log in to the CCM console.
2. In the navigation pane on the left, choose SSL Certificate Manager > SSL Certificates. In the row containing the desired certificate, click Verify Domain Name in the Operation column. The Verify Domain Name page is displayed.
3. On the Verify Domain Name page, view the Record Value.

   If the page is not displayed, log in to your email (the one specified during certificate application) to view the recorded value.

   Figure 1 File verification
   

Step 2: Creating the Required File

1. Log in to your server and ensure that the domain name points to the server and the website is enabled.
2. Create a file in the root directory of the website. You need to specify the file directory, file name, and content.
   

   The root directory of the website refers to the folder where the website programs are stored on the server. The root directory has the following names: wwwroot, htdocs, public_html, webroot, and more. Use the one you actually use for your website.

   The following uses Linux servers as an example. Assume that the root directory of the website is /www/htdocs.

   1. Run the commands below to create the .well-known/pki-validation subdirectory in the root directory of the website.

      In this example, the subdirectory is created in the /www/htdocs directory.

      cd /www/htdocs
      mkdir .well-known
      cd .well-known
      mkdir pki-validation
      cd pki-validation

   2. Run the command below to create the fileauth.txt file in the .well-known/pki-validation subdirectory.
      

      The following uses the fileauth.txt returned by the GeoTrust as an example. Replace fileauth.txt with the actual file name.

      echo off>fileauth.txt

   3. Run the following commands to open the fileauth.txt file:

      start fileauth.txt

   4. Put the record you obtained in 3 into the fileauth.txt file and choose File > Save in the upper left corner.

Step 3: Checking Whether the Verification Configuration Takes Effect

1. Open a browser and access the URL address: https://your_domain/.well-known/pki-validation/fileauth.txt or http://your_domain/.well-known/pki-validation/fileauth.txt.

   Replace your_domain in the URL address with the domain name bound during certificate application.

   • If your domain name is a common domain name, perform the following operations:

     For example, if your domain name is example.com, the access URL address is https://example.com/.well-known/pki-validation/fileauth.txt or http://example.com/.well-known/pki-validation/fileauth.txt.

   • If your domain name is a wildcard domain name, perform the following operations:

     For example, if your domain name is *.domain.com, the access URL address is https://domain.com/.well-known/pki-validation/fileauth.txt or http://domain.com/.well-known/pki-validation/fileauth.txt.

2. Check whether the verification URL address can be properly accessed in the browser and whether the record value displayed on the page is the same as that on the order progress page.
   • If the record value displayed on the page is the same as that displayed on the domain name verification page of the SCM console, the configuration of domain name verification has taken effect.
   • If they are different, the configuration of domain name verification does not take effect.

3. If the configuration does not take effect, check and handle the issue from the following aspects:
   • Check whether the verification URL address exists in HTTPS accessible addresses. If yes, access the URL using a browser over HTTPS again. If the browser displays a message indicating that the certificate is untrusted or incorrect content is displayed, disable the HTTPS service for the domain name temporarily.
   • Ensure that the verification URL address can be accessed at any place. Detection servers of some CAs are located outside China. Check whether your site has images outside China or whether the smart DNS service is used.
   • Check whether the verification URL address contains 301 or 302 redirections. If such redirection exists, cancel the related settings to disable the redirection.

     You can run the wget -S URL address command to check whether the verification URL address is redirected.

FAQ

What Can I Do If Domain Ownership Verification Does Not Take Effect?

How Do I Query a Domain Name Provider?

How Do I Use DNS to Verify Domains Not Hosted on Huawei Cloud?

Why Does the SSL Certificate Remain in the Pending Domain Name Verification State (Application Progress Is 40%) After Domain Name Verification Is Complete?