Completing Domain Control Validation for HTTPS with DV SAN

Configuring Apache

To configure Apache, follow these steps:

1. Log in to the machine running the Apache2 server.

2. Create the challenge response file for the challenge response under .well-known/acme-challenge/ in the directory for your website content. The default location for Apache2 website content is /var/www/html/. For this example, the challenge response is placed in the /var/www/html/.well-known/acme-challenge/ directory.

   mkdir -p /var/www/html/.well-known/acme-challenge && \
   printf "examplechallenge" > /var/www/html/.well-known/acme-challenge/examplechallenge-fileobject
   

3. Optionally, open your Apache2 server configuration file. /etc/apache2/apache2.conf and /etc/apache2/sites-enabled/ are the default locations for configuration files.

4. Optionally, add your CDN domain as an additional ServerAlias to the virtual host for your origin.

5. If you modified your Apache2 server configuration, restart the Apache2 server with minimal down time by using the following command:

   apachectl -k graceful
   

6. Create an A record in your DNS between the CDN domain and the origin server's IP address.

Configuring Nginx

To configure Nginx, follow these steps:

1. Log in to the machine running the Nginx server.

2. Create the challenge response file for the challenge response under .well-known/acme-challenge/ in the directory for your website content. The default location for Nginx website content is /usr/share/nginx/html/. For this example, the challenge response is placed in the /usr/share/nginx/html/.well-known/acme-challenge/ directory.

   mkdir -p /usr/share/nginx/html/.well-known/acme-challenge && \
   printf "examplechallenge" > /usr/share/nginx/html/.well-known/acme-challenge/examplechallenge-fileobject
   

3. Optionally, open your Nginx server configuration file. /etc/nginx/nginx.conf and /etc/nginx/conf.d/ are the default locations for configuration files.

4. Optionally, add your CDN domain as an additional server_name to the server block for your origin.

5. If you modified your Nginx server configuration, restart the Nginx server with minimal down time by using the following command:

   nginx -s reload
   

6. Create an A record in your DNS between the CDN domain and the origin server's IP address.

Verify that this Standard method to address domain validation is ready for the CA

• To verify this method works through curl, run that command for the Challenge URL.

  curl -v http://cdn.example.com/.well-known/acme-challenge/examplechallenge-fileobject
  

• To verify this method works through a browser, attempt to access the Challenge URL from your browser.

In either case, you should be able to retrieve the copy of the Domain Validation Challenge file object stored on your origin server.

Cleaning up for the Standard method

After your CDN has reached Certificate deploying status:

1. Remove the examplechallenge-fileobject file. (optional)
2. Optionally, remove the added ServerAlias (Apache2) or the server_name (Nginx) from your server configuration.
3. Remove the A record between the CDN domain and the origin server IP.

Apache redirect configuration

To configure an Apache redirect, follow these steps:

1. Log in to the machine running the Apache2 server.

2. Open your Apache2 server configuration file. /etc/apache2/apache2.conf and /etc/apache2/sites-enabled/ are the default locations for the configuration file.

3. Add a redirect statement in the appropriate location within the configuration file. If needed, add your CDN domain as an additional ServerAlias to the virtual host for your origin.

   Redirect /.well-known/acme-challenge/examplechallenge-fileobject http://dcv.akamai.com/.well-known/acme-challenge/examplechallenge-fileobject
   

4. Restart the Apache2 server with minimal downtime by using the following command:

   apachectl -k graceful
   

5. Create an A record in your DNS between the CDN domain and the origin server's IP address.

Nginx redirect configuration

To configure an Nginx redirect, follow these steps:

1. Log in to the machine running the Nginx server.

2. Open your Nginx server configuration file. /etc/nginx/nginx.conf and /etc/nginx/conf.d/ are the default locations for the configuration files.

3. There are two equally valid methods for this step.

   • Option 1: (recommended) Add a location block with a return directive to perform the redirect within the appropriate server block. If needed, add your CDN domain as an additional server_name to the server block for your origin.

      server {
        listen 80;
        server_name origin.example.com cdn.example.com;
     
        # Some server configuration directives
        # ...
     
        location = /.well-known/acme-challenge/examplechallenge-fileobject  {
            return 302 http://dcv.akamai.com$request_uri;
        }
     
        # Some more server configuration directives
        # ...
      }
     

   • Option 2: Add a rewrite directive within the server block. If needed, add your CDN domain as an additional server_name to the server block for your origin.

     server {
       listen 80;
       server_name origin.example.com cdn.example.com;
     
       # Some server configuration directives
       # ...
     
       rewrite ^/(\.well-known/acme-challenge/examplechallenge-fileobject)$ http://dcv.akamai.com/$1 redirect;
     
       # Some more server configuration directives
       # ...
     }
     

4. Restart the Nginx server with minimal downtime by using the following command:

    nginx -s reload
   

5. Create an A record in your DNS between the CDN domain and the origin server's IP address.

Verify that the redirect is occurring

Completing these steps redirects only the traffic for the specific Challenge URL to the URL Redirect. You can verify that the redirect worked either through curl or through the browser.

• To verify that redirect works through curl, run that command for the Challenge URL.

  curl -vL http://cdn.example.com/.well-known/acme-challenge/examplechallenge-fileobject
  

• To verify that redirect works through the browser, attempt to reach the Challenge URL from your browser.

In either case, you should be able to retrieve the copy of the Domain Validation Challenge file object from Akamai at the dcv.akamai.com domain, to which the original request was redirected.

Clean up for the Redirect method

After your CDN indicates Certificate deploying status, you can:

1. (Optional) Remove the redirect statements or blocks from the configuration file.
2. (Optional) Remove the added ServerAlias (Apache2) or the server_name (Nginx) from your server configuration, if needed.
3. Remove the A record between the CDN domain and the origin server IP.