HTTP-01 validation
Serve a challenge token from /.well-known/acme-challenge/ on port 80. The platform can host the token for names that already point here.
Managed challenge proxy
When a hostname already resolves to this application, GET /.well-known/acme-challenge/{token} serves the stored key authorization for pending HTTP-01 challenges.
Manual HTTP
If the hostname is on another origin, place the token yourself and call the order validate endpoint. The platform will not pretend a challenge succeeded without a driver confirmation.
Limits
HTTP-01 cannot validate wildcards and requires an HTTP listener the CA can reach. Use DNS-01 when that is not true.