The key point
Use a validation method for which you control the required DNS, mailbox or web server. Follow the exact instructions in the certificate setup.
DNS record
Publish the record type, host and value shown in setup at your authoritative DNS provider. DNS validation supports wildcards. Check public visibility and any proxy or automatic domain suffix behaviour. Keep using the current challenge. An old record is not a promise of approval for future orders.
Approver email
Choose an address offered in setup. Constructed addresses can include admin@, administrator@, hostmaster@, postmaster@ or webmaster@ for the authorised domain. Your account email is not automatically eligible. Make sure you can receive and act on the CA message.
File upload
Publish the exact token file at the URL shown in setup, commonly under /.well-known/pki-validation/. It must be reachable by the CA with the expected content. File validation covers the exact hostname, not wildcard scope. Check each additional name separately.
Worked example
Pick a method you can actually complete
You are setting up a certificate for shop.example.com. Your hosting and DNS access determine which validation method is practical. The CA challenge is order-specific, so these are scenarios rather than tokens to copy.
- You manage DNS
- Publish the exact record type, name and value shown in setup. Check for a duplicated domain suffix in the DNS panel.
- You manage an approved mailbox
- Select an address offered in setup, check spam or quarantine folders and follow the CA email.
- You can publish a validation file
- Serve the exact file at the required hostname and path, without a sign-in page or an application error page.
- You need wildcard coverage
- Use an available DNS or approver-email method. File validation is not available.
Your next steps
- Confirm your access before choosing the method. Website access does not necessarily include DNS access.
- Copy the current challenge exactly and keep it reachable while validation is pending.
- If validation stalls, check the selected hostname, record or file, mailbox delivery and any CA error before retrying.