{"id":"774eaa86-7f39-4f42-9270-9fb7e7967906","task":"Obtain a certificate using webroot mode so a currently running web server (e.g. nginx or Apache) keeps serving traffic uninterrupted during the http-01 challenge, by dropping a challenge file into its document root.","domain":"certbot.eff.org","steps":["Install Certbot per https://certbot.eff.org/instructions.","Confirm your running web server serves static files (including hidden directories like /.well-known/) from a known document root, e.g. /var/www/html or /usr/share/nginx/html.","Run: sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com","For multiple domains with different document roots on one certificate, repeat -w before the -d flags it should apply to: certbot certonly --webroot -w /var/www/example -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net","Certbot writes a temporary file under ${webroot-path}/.well-known/acme-challenge/ and Let's Encrypt's validation servers fetch it over plain HTTP on port 80 to confirm control of the domain.","If your web server config specially handles or blocks dotfiles/hidden paths, adjust it so requests to /.well-known/acme-challenge/ are served normally.","Because webroot doesn't install the cert, manually configure your web server to use the files under /etc/letsencrypt/live/example.com/, or combine authenticator+installer plugins (e.g. certbot run -a webroot -i apache -w /var/www/html -d example.com).","Official docs: https://eff-certbot.readthedocs.io/en/stable/using.html"],"gotchas":["Webroot mode still uses the http-01 challenge on port 80 under the hood, so port 80 must be reachable from the internet even though Certbot itself isn't binding it — the running web server must be listening there.","When requesting a cert for multiple domains, each domain uses the most recently specified --webroot-path on the command line, so ordering of -w/-d flags matters.","Your web server must actually be configured to serve files from inside /.well-known/acme-challenge; some configs treat dot-directories specially and block them by default.","certonly (used here) does not install or reload the web server config for you — you must wire in the cert/key paths manually, or use combined authenticator/installer invocations."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T05:32:02.337Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T05:32:02.337Z"},"url":"https://mcp.waymark.network/r/774eaa86-7f39-4f42-9270-9fb7e7967906"}