# Support for HTTPS only with http-01 challenge? **URL:** \ **Category:** Issuance Tech\ **Created:** [April 30, 2016, 10:58am UTC](https://community.letsencrypt.org/t/support-for-https-only-with-http-01-challenge/15134 "2016-04-30T10:58:33Z")\ **Posts on this page:** 1\ **Showing post:** 43
**Author:** ![tialaramex](https://avatars.discourse-cdn.com/v4/letter/t/f08c70/32.png) [@tialaramex](https://community.letsencrypt.org/u/tialaramex)\ **Post date:** [May 16, 2016, 12:07am UTC](https://community.letsencrypt.org/t/support-for-https-only-with-http-01-challenge/15134/43 "2016-05-16T00:07:48Z")
The answer to your question (“Why LE refuse…”) is that in ACME testing they found many hosted HTTPS servers which would serve site A’s contents when asked for site B. This meant if http-01 was enabled for HTTPS then the owner of site A could impersonate site B as far as ACME is concerned, obtaining a valid certificate for site B even though they had no entitlement to such a certificate. Undoubtedly these servers shouldn’t be set up that way, but they are. We can’t write security software for a world we wish we have, only for the world we do have. So http-01 isn’t safe against HTTPS servers. Likewise, outside of ACME it was contemplated that surely an ordinary web server would never respond to a request for a well-known URL with a chosen string in it, with that exact string. For example, when asked for .well-known/pki-verification/47sd84f92kd03 why would it say “47sd84f92kd03” ? But in fact lots of them do, as a result of primitive SEO seeing and suchlike so the Baseline Requirements had to be tightened up to make it clear that’s not enough verification. --- _[View the full topic](https://community.letsencrypt.org/t/support-for-https-only-with-http-01-challenge/15134)._