What Is the .well-known Folder and How to Create It?

This quick guide answers one of the most common questions during Domain Control Validation (DCV): what is the .well-known folder? You will also learn how to create the .well-known folder on your server and why you need it in the first place.

---

Table of Contents

1. What Is the .well-known Folder?
2. What Should I Put in the .well-known Directory?
3. How to Create the .well-know Folder?

---

What Is the .well-known Folder?

Inside your ~/public directory on your server, you might find the .well-known folder. Well-known URIs are Uniform Resource Identifiers for well-known services or information available consistently across servers at URLs.

Some servers create the .well-known folder automatically, but sometimes, you may have to add it manually. This directory acts as a web-based protocol to fetch site metadata about a host before making a request.

What Is the .well-known Folder used for?

When ordering an SSL Certificate, you must prove domain ownership as part of DCV. If you choose the HTTP/HTTPS method, you’ll have to create the .well-known directory, the folder where you must upload a TEXT file for the CA to scan and approve your SSL request.

The file should be accessible via a live website link. After you add the validation file, the CA crawler system will scan your website and look for the file. Once it finds it, you should pass domain validation within minutes.

---

What Should I Put in the .well-known Directory?

To confirm you are the owner of the domain name using the HTTP method, you’ll have to upload a TXT file to a location on your website and server that looks like this:

http://mywebiste.com/.well-known/pki-validation/HashFileName.txt

As you can see from the URL path, you should place the file in the .well-known folder and the pki-validation subfolder of the document root directory for the domain name.

You can download the validation file after you select the HTTP method when ordering your SSL certificate. The hash file name is a string of random characters. You must upload it as it comes from the CA without changing its name or content.

---

How to Create the .well-know Folder?

To create the well-known folder, you’ll need access to your server via an SFTP client, a web hosting control panel, or any other appropriate means.

Here’s how to create the .well-known folder on the most popular platforms:

How to Create the .well-known Folder on Linux-Based Servers?

The instructions below are valid for Ubuntu, Debian, and CentOS servers.

1. Go to the root directory of your website
2. Create a directory called “.well-known“
3. Inside it, create another folder called “pki-validation“
4. Upload the TXT file inside the “pki-validation” directory

---

How to Create the .well-known Folder in cPanel?

1. Log into WHM, or skip this step if you don’t have WHM
2. Locate and log into the cPanel account for your domain name
3. Click on “File Manager”
4. Choose the “Web Root (public_html/www)” option and click “Go.”
5. Create a new folder called “.well-known”
6. Inside that folder create another folder called “pki-validation”
7. Upload your TXT file inside the “pki-validation” folder.

---

How to Create the .well-known Folder in Plesk?

1. Use the “File Manager” option and go to the “Files” section in the right-side menu.
2. You should create the “.well-known” folder in the default document root folder for your domain, which in Plesk is “httpdocs”.
3. To create the folder, select “New”, then “Create Directory”.
4. Inside the “.well-known” folder, create the “pki-validation” subfolder.
5. Use the “Upload” button to add the validation TXT file into the “pki-validation” folder.

---

How to Create the .well-known Folder in Windows IIS Servers?

Windows-based servers do not allow you to place a dot in a folder name, therefore you need to follow these steps:

1. Go to the C: drive
2. Create a new folder called “well-known”
3. Inside the “well-known” folder, create another folder named “pki-validation”
   So far, your folders should look like this: C:well-knownpki-validation
4. Upload the TXT file in the “pki-validation folder”
5. Open the IIS Manager on your server
6. Do right-click on your website and select “Add Virtual Directory”
7. In the Alias section write “.well-known”
8. In the “Psychical Path” area enter the path to the “well-known” folder. For example:
   C:well-known
9. Press “OK” to create this alias.

---

How to Create a .well-known Folder in WordPress?

You can create a .well-known folder in WordPress in three different ways.

1. Using a special plugin
2. Through your web-hosting panel
3. Via an SFTP Client such as FileZilla

We don’t recommend using a plugin as it may cause compatibility and security issues over time. Instead, use our instructions above to create the .well-known folder in cPanel, the most popular hosting panel.

If you don’t have cPanel, use an SFTP client. Connect to your server and inside your ~/public folder look for the “.well-knwon” directory. If it’s not there, right-click on the public folder, choose “Create directory”, and name the new directory “.well-known”.

---

How to Create a .well-known Folder in AWS?

1. Use the bash command to create the .well-known.folder in the AWS EC2 instance:
   
   mkdir -p .well-known/pki-validation
   
2. Put your validation file in the pki-validation subfolder:
   
   nano .well-known/pki-validation/HashFileName.txt
   

---

How to Create the .well-known in macOS X Server?

Connect to your server via the built-in FTP client or the Command Line Interface.

FTP

1. Press Command + K
2. In the “Connect to Server” window, enter the address of the FTP server. For example, ftp://ftp.yourdomain.com. Click “Connect”.
3. Next, enter your FTP username and password and hit “Connect” again.
4. Find the root directory of your domain.
5. Create a directory called “.well-known”
6. Inside the “.well-known” folder, create another folder called “pki-validation”.
7. Upload the TXT file inside the “pki-validation” directory

---

Command Line Interface

You can use SSH and the Secure Copy protocol to upload the TXT file.

scp AC3E5D6I8G12935LSJEIK.txt

your_username@hostname:tld://Library/WebServer/Documents/.well-known/pki-validation

Where “AC3E5D6I8G12935LSJEIK.txt” is the validation file name, “your_username” is the username of your server account, “hostname.tld” is your Mac OSX server hostname, and “/Library/WebServer/Documents/” is the default directory of the document root folder.

For all server types, if you did everything correctly, you should be able open the following URL and see the hash code along with “comodoca.com” in any web browser:

http://mywebsite.com/.well-known/pki-validation/HashFileName.txt

---

Frequently Asked Questions

What If the .well-known Folder Already Exists for SSL?

If the .well-known folder exists on your server, open it, then create the pki-validation sub-folder and upload the file.

Why Is .well-known Directory Protected?

Since it’s a public directory, the .well-known folder is often protected to prevent hackers from storing and distributing ransomware and phishing pages. You may need to change the file permissions to access it.

How to Move the .well-known Directory?

The .well-known folder must always remain in your public directory. If you move it to another location, you won’t be able to pass the SSL validation via the HTTP method.

Should I Remove the well-known Folder?

Yes, it’s needed each time you renew the SSL Certificate. The CA still has to verify if you’re the domain name’s owner.

---

Conclusion

The HTTP/HTTPS validation process is pretty straightforward. You should get your SSL certificate in no time if you follow the exact steps outlined above. Now that you know what the .well-known folder is and how to create it on different servers, renewing your certificate or getting a new one will be much faster.