|
ACME HTTP-01 if server redirect to 443
Thinking
Searching
Yes,
ACME HTTP-01 challenges support redirects from port 80 to port 443 (HTTPS). This is a standard practice that allows you to maintain a secure-by-default configuration while still automating certificate renewals.
Key Rules for Redirects
Initial Request: The validation server (e.g., Let's Encrypt) must always start its request on port 80 using HTTP. You cannot skip port 80 and start on 443 for an HTTP-01 challenge.
Supported Ports: The challenge follows redirects only to port 80 or 443. Redirecting to a custom port like 8443 or 10000 will cause the challenge to fail.
Redirect Depth: Most ACME implementations, including Let’s Encrypt, will follow up to 10 redirects deep.
Certificate Validation: When the challenge is redirected to HTTPS (port 443), the CA does not validate the target's SSL certificate. This allows the challenge to succeed even if your current certificate is expired, self-signed, or missing. |
