HTTPS encrypts traffic between the browser and web server. The server needs a valid certificate, and the domain must verifiably point to the correct server.
This guide explains Let's Encrypt validation methods, the requirements for automatic renewal and common errors that block certificate issuance.
What does the certificate verify?
A certificate binds the domain name to a public key, allowing the browser to establish an encrypted connection with the server. Before issuing a certificate, Let's Encrypt verifies that the applicant controls the domain.
Open image full size Pre-order checklist
- The domain and, where needed, www DNS records point to the server installing the certificate.
- The domain is assigned to the correct website or virtual host.
- For HTTP-01 validation, port 80 must be externally reachable and redirects or access rules must not block /.well-known/acme-challenge/.
- For DNS-01 validation, the domain's DNS zone can be edited and the validation TXT record appears on the active nameserver.
- Every name in the request can be validated separately.
HTTP-01 vagy DNS-01?
| Mode | How does it verify? | Mikor hasznos? |
|---|---|---|
| HTTP-01 | Retrieves a temporary file from the website on port 80. | For standard websites when the server is publicly reachable. |
| DNS-01 | Looks for a TXT record at _acme-challenge. | For wildcard certificates or DNS management that can be automated. |
What to check after release
- Install the complete certificate chain for the correct website.
- Open every domain variant in use over HTTPS and check for certificate name or chain errors.
- Only then configure HTTP → HTTPS redirection, if your validation method allows it.
- Configure automatic renewal and failure alerts. Test renewal in a dry run too.
- Check that the page does not load images, scripts or styles over unencrypted HTTP.
If the certificate request fails
| Symptom | Likely checkpoint |
|---|---|
| A domain nem erre a szerverre mutat | A/AAAA/CNAME records, active nameservers and DNS cache. |
| Timeout vagy connection refused | Port 80, firewall, proxy and web server reachability. |
| Unauthorized | Challenge path, redirects, permissions and virtual host. |
| One hostname works, another does not | DNS for every domain and subdomain variant in the request. |
| Renewal failed | Changed DNS, a disabled website, an expired API key or altered configuration. |
