HTTP DCV method
When you choose HTTP DCV, Cloudflare automatically adds a verification HTTP token to your domain.
Only use this method if your domain can tolerate a few minutes of downtime.
HTTP DCV validation also does not work for wildcard certificates or certificates with multiple SANs.
Selecting Let’s Encrypt as a CA limits a certificate to a TXT Certificate validation method, 90 days for the Certificate Validity Period, two host entries (one for the zone name and one for the subdomain wildcard of the zone name, such as
If using the API to order your certificate, this action also defaults
Specify DCV method
In either case, you would need to set a
Review other Cloudflare settings
This process may involve a few minutes of downtime. Cloudflare contacts one of our Certificate Authority providers and asks them to issue certificates for the specified hostname. The CA will then inform Cloudflare that we need to “demonstrate control” of this hostname by returning a For example, if you create a new custom hostname for
What happens after you create your records
$DCV_TOKEN at a specified
$DCV_FILENAME; both the token and the filename are randomly generated by the CA and not known to Cloudflare ahead of time.
site.example.com, the CA might ask us to return the value
ca3-38734555d85e4421beb4a3e6d1645fe6 for a request to
http://site.example.com/.well-known/pki-validation/ca3-39f423f095be4983922ca0365308612d.txt". As soon as we receive that value from the CA we make it accessible at our edge and ask the CA to confirm it’s there so that they can complete validation and the certificate order.
Cloudflare contacts one of our Certificate Authority providers and asks them to issue certificates for the specified hostname. The CA will then inform Cloudflare that we need to “demonstrate control” of this hostname by returning a
For example, if you create a new custom hostname for
To check whether your certificates have been validated and reissued:
- Dashboard: Find the certificate(s) SSL/TLS > Edge Certificates and make sure that the Status is Active.
- API: Send a request and confirm that your certificate(s) have
Renew DCV tokens
However, some certificates — for example, if you are using wildcard certificates or certificates with multiple SANs or your hostname is not proxied — are not eligible for HTTP validation.
If your certificate is not eligible for HTTP validation, you will need to repeat the DCV process with your chosen method.