Knowledge Base
How to create a .wellknown/pki-validation folder on a Windows IIS server
Overview
By the end of this guide, you will have created a .wellknown/pki-validation folder on a Windows server running Internet Information Services (IIS) and placed a validation file inside it, so the file can be reached over HTTP for domain or organization validation. Because Windows File Explorer cannot create folder names that begin with a dot, the procedure uses Command Prompt to create the .wellknown folder and its pki-validation subfolder, then adds the validation file (for example, sectigo.html). The guide covers identifying the site's root directory in IIS, creating the folders and file, configuring access to the file, and verifying that it loads correctly in a browser.
Before you begin, make sure you have the following:
-
Administrative access to the Windows server hosting IIS
-
Access to IIS Manager on the server
-
Permission to use Command Prompt on the server
-
The validation value provided by Sectigo (the random value for your certificate order)
Steps
Step 1 — Identify the website root directory in IIS
Open IIS Manager, expand Sites, and select the relevant website (for example, Default Web Site). In the Actions panel, click Explore to open the site's physical root directory in File Explorer. This confirms the correct path where the folders must be created.
Figure 1: IIS Manager with the Explore action selected, opening the site's physical root (C:\inetpub\wwwroot) in File Explorer.
Step 2 — Open Command Prompt
Windows File Explorer cannot create folders whose names begin with a dot (.), such as .wellknown. Open Command Prompt with administrator privileges to create these directories.
Step 3 — Navigate to the website root path
Using the path confirmed in Step 1, change to the website's physical directory. In this example, the path is:
cd C:\inetpub\wwwroot\
Step 4 — Create the .wellknown folder
From the website root directory, run the following command:
mkdir .wellknown
Step 5 — Create the pki-validation subfolder
Create the pki-validation subfolder inside .wellknown:
mkdir .\.wellknown\pki-validation
Figure 2: Administrator Command Prompt showing the dir listing with the .wellknown and pki-validation folders and the sectigo.html validation file.
Step 6 — Create the validation file
Go to the pki-validation folder:
C:\inetpub\wwwroot\.wellknown\pki-validation
Create a file named sectigo.html and paste in the validation value provided for your certificate order. Save the file.
Step 7 — Configure access to the validation file
Make the validation file reachable in a browser using one of these options:
-
Option 1: In IIS Manager, create a virtual directory mapped to C:\inetpub\wwwroot\.wellknown\pki-validation.
-
Option 2: If static content is already enabled in IIS, no changes are needed — you can access the file directly in a browser.
Figure 3: IIS Manager Virtual Directories view showing the /sectigo virtual path mapped to the pki-validation physical folder.
Verification
To confirm the setup worked, open a browser and go to the validation file's Uniform Resource Locator (URL):
The file should load and display the expected validation value, with no errors such as 404 (not found) or access denied.
Figure 4: Browser loading the validation file at its .wellknown/pki-validation URL and displaying the validation value.
Related articles
Need assistance?
Contact our team for help with your purchase or issuing your certificate.
Live chat
Click the button below or click "Chat with an Expert" to start chatting with us now!
