Checking rights for a domain

To get and renew a Let's Encrypt certificate, check the rights for each domain specified in the certificate. In Certificate Manager, there are two types of checks available: HTTP and DNS. When you create a certificate, you can choose any type of check. Checking rights for domains may take a long time.

Certificate Manager waits for each domain from the certificate to pass the check (all checks have the Valid status). After that, Let's Encrypt will issue a certificate. Then the certificate changes its status to Issued and you can use it in services integrated with Certificate Manager.

If you fail to pass the check within one week, the certificate status will become Invalid (if you are obtaining the certificate) or Renewal_failed (if you are renewing the certificate). To obtain a certificate after that, request another certificate from Let's Encrypt.

Certificate challenge statusesCertificate challenge statuses

Certificate checks can have the following statuses:

• Pending: Awaiting completion. Certificate Manager determines whether the check is complete.
• Validating: Pending approval from Let's Encrypt.
• Valid: Complete.
• Invalid: Checking the rights for a specific domain failed or the one-week period allocated for the procedure expired.
• Renewal_failed: Checking the rights upon certificate renewal failed or the one-week period allocated for the procedure expired.
• Issued: Certificate is issued.

HTTPHTTP

To check the rights for the example.com domain:

1. In the management console, select the folder the certificate was added to.

2. In the list of services, select Certificate Manager and click the name of the certificate you need.

3. Prepare a file that will allow the Let's Encrypt certificate authority (CA) to verify your ownership of the domain specified in the certificate:

   1. Use your hosting control panel to create a file on the server with the name and path matching the value of the Link for hosting file field under HTTP record. For example:

      • /.well-known/acme-challenge/: Path to the file.
      • di2o3VRsbS6H_eUntKnW3Xcefw_1DOSpZ1B********: File name.

   2. Insert into the file you created the value of the Contents field from HTTP record. For example:

      di2o3VRsbS6H_eUntKnW3Xcefw_1DOSpZ1BLW0QUDbE._TYLpfPMbwHQZ1aEmsdpidY5bPUnVyDvqSO********

   As a result, on your web server, you should have a file named http://example.com/.well-known/acme-challenge/di2o3VRsbS6H_eUntKnW3Xcefw_1DOSpZ1B******** with this text inside it: di2o3VRsbS6H_eUntKnW3Xcefw_1DOSpZ1BLW0QUDbE._TYLpfPMbwHQZ1aEmsdpidY5bPUnVyDvqSO********.

4. Wait for the Let's Encrypt CA to issue a certificate and its status to change to Issued.

5. Delete the file created for certificate verification from your web server.

DNSDNS

If you do not have access to the web server or you need to get a Wildcard certificate with masks for subdomains in *.example.com format, use the DNS check type.

To pass the check, you need to add a special DNS record of one of the following two types: TXT or CNAME.

When using a TXT record, you will have to pass the check every 60 days as part of the automatic certificate renewal.

Using a CNAME record enables you to undergo a check only once. To do this, you need to delegate to Certificate Manager the right to respond in the domain's DNS zone used for the check. This will pass the check.

Adding a CNAME recordAdding a CNAME record

To automatically check the rights for the example.com domain:

1. In the management console, select the folder the certificate was added to.

2. In the list of services, select Certificate Manager.

3. In the certificate list, select the certificate to check.

4. Further steps to follow will depend on whether your domain is managed by Yandex Cloud DNS or a third-party DNS provider.

   Yandex Cloud DNS

   Third-party DNS provider

   Under Check rights for domains, in the CNAME record type section, click Create record in the Cloud DNS field. In the window that opens:

   1. If the current folder contains an appropriate DNS zone, it will be automatically inserted into the Zone field. If there is no appropriate DNS zone, click Create zone and set its parameters to create a new zone.
   2. Click Create.

   1. Under Check rights for domains, in the CNAME record type section, check out the record value for the domain in the Value field.

   2. Add a CNAME record to your DNS provider or to your own DNS server to delegate management privileges to the DNS zone used for the check:

      _acme-challenge.example.com CNAME <value>
      

      The <value> string is formatted as follows: <certificate_ID>.cm.yandexcloud.net.

      For a successful DNS domain rights check based on a CNAME record, make sure the _acme-challenge subdomain of the domain name you are checking has no other resource records except CNAME. For example, for the _acme-challenge.example.com. domain name, there should only be a CNAME record and no TXT record.

   Note

   Checking rights for domains may take from a few hours to a few days.

Adding a TXT recordAdding a TXT record

To check the rights for the example.com domain:

1. In the management console, select the folder the certificate was added to.

2. In the list of services, select Certificate Manager.

3. In the certificate list, select the certificate to check.

4. Further steps to follow will depend on whether your domain is managed by Yandex Cloud DNS or a third-party DNS provider.

   Yandex Cloud DNS

   Third-party DNS provider

   Under Check rights for domains, in the TXT record type section, click Create record in the Cloud DNS field. In the window that opens:

   1. If the current folder contains an appropriate DNS zone, it will be automatically inserted into the Zone field. If there is no appropriate DNS zone, click Create zone and set its parameters to create a new zone.
   2. Click Create.

   1. Under Check rights for domains, in the TXT record type section, check out the record value for the domain in the Value field.

   2. Add a TXT record to your DNS provider or to your own DNS server:

      _acme-challenge.example.com. IN TXT <value>
      

   Note

   Checking rights for domains may take from a few hours to a few days.

5. After the certificate status changes to Issued, delete the TXT record you added from the DNS server.

Validating rights automaticallyValidating rights automatically

In some cases, the domain rights check requires no user input.

CNAME record applicable to a zoneCNAME record applicable to a zone

A check is performed automatically if the following conditions are met:

• The certificate’s status is Renewing, which means it is being renewed.

• There is a DNS record configured for each certificate domain:

  _acme-challenge.example.com CNAME <certificate_ID>.cm.yandexcloud.net.
  

Redirecting a static Object Storage websiteRedirecting a static Object Storage website

A check is performed automatically if the following conditions are met:

• The certificate’s status is Renewing, which means it is being renewed.
• The certificate is used in the HTTPS configuration of a static website in Object Storage.
• For each certificate domain, the following is configured:
  • An alias for the static website bucket where the certificate is used.
  • Or a redirect to the domain with the alias for the bucket.
• The certificate is not a Wildcard certificate: it does not contain masks for subdomains.

Redirecting to a validation server on a web serverRedirecting to a validation server on a web server

A check is performed automatically if the following conditions are met:

• The certificate’s status is Renewing, which means it is being renewed.
• The certificate is not a Wildcard certificate: it does not contain masks for subdomains.
• For each certificate domain in the web server, a redirect is configured from

  http://<domain>/.well-known/acme-challenge/*
  

  to

  https://validation.certificate-manager.api.cloud.yandex.net/<certificate_ID>/*
  

  This endpoint is only available over IPv6.

Example of setting up a redirect in the nginx configuration:

server {
  location ~ ^/.well-known/acme-challenge/([a-zA-Z0-9-_]+)$ {
    return 301 https://validation.certificate-manager.api.cloud.yandex.net/<certificate_ID>/$1;
  }
}

See alsoSee also

• Let's Encrypt documentation: Types of challenges