EXERCISE 2 — HTTP-01 vs DNS-01, and why wildcards need DNS-01
=============================================================

HOW HTTP-01 PROVES DOMAIN CONTROL:
  - The CA gives you a token. You must serve it as a file at:
        http://example.com/.well-known/acme-challenge/<token>
  - The CA then makes an HTTP request to that exact URL on your domain.
  - To place a file at that path on example.com, you must control the web
    server that answers for example.com. So a successful fetch proves you
    control THAT hostname's web root.
  - Scope of proof: control of the specific hostname being requested.

HOW DNS-01 PROVES DOMAIN CONTROL:
  - The CA gives you a value. You must create a DNS TXT record:
        _acme-challenge.example.com.  TXT  "<value>"
  - The CA queries DNS for that record.
  - Only someone who controls the domain's DNS ZONE can create records
    under example.com. So a matching TXT record proves you control the
    domain's DNS — i.e. authority over the whole zone.
  - Scope of proof: control of the DNS zone (the entire domain namespace).

WHICH ONE FOR A WILDCARD *.example.com:  DNS-01 (REQUIRED).

WHY HTTP-01 CANNOT WORK FOR A WILDCARD:
  - A wildcard cert *.example.com is valid for EVERY possible subdomain:
    a.example.com, b.example.com, login.example.com, ...an unbounded set.
  - HTTP-01 proves control of ONE specific hostname's web root at a time.
    Serving a token on one host (or even a few) does NOT demonstrate
    authority over every conceivable subdomain — you can't place a file on
    infinitely many hosts, and many may not even exist yet.
  - The only thing that legitimately proves authority over the ENTIRE
    subdomain namespace is control of the DNS zone itself. DNS-01 checks a
    TXT record in that zone, which exactly demonstrates that authority.
  - Therefore Let's Encrypt (and the CA/Browser rules) REQUIRE DNS-01 for
    wildcard issuance. HTTP-01 and TLS-ALPN-01 are not accepted for
    wildcards.

SUMMARY:
  HTTP-01  -> proves control of a single hostname (web root). Simple, common.
  DNS-01   -> proves control of the DNS zone. Needed for wildcards and for
              hosts not publicly reachable over HTTP.