The ACME spec lists a number different challenges:
- Identifier Validation Challenges
7.1. Simple HTTP
7.2. Domain Validation with Server Name Indication (DVSNI)
7.3. Proof of Possession of a Prior Key
If I had to summarize the detailed process (about two screens full) given in section 7.1. Simple HTTP, then I'd say it goes a something like this:
Client: Hey server, my customer number is
x, challenge me!
Server: Okay, put a file named
y on your HTTP(S) server and sign it with your customer number key.
Server: Lemme check... Okay, here's your certificate.
There is also a description of that process with screenshots.
Does the client decide which port is used?
Yes. But you can only pick between http on 80 or https on 443.
There is a long-running discussion about whether to allow other ports.
Can the data be put anywhere within the server?
No. I think you're bound to this path:
The path at which the resource is provisioned is comprised of the fixed prefix “
.well-known/acme-challenge/”, followed by the “token” value in the challenge.