Public access to /.well-known/acme-challenge/

[ampersx1]

Hi there,

I am having real trouble with getting an acme-challenge working to get my own SSL cert to work.

I can put the challenge file in the .acme-challenge folder (or get win-acme v2.2.9 to create it automatically) and can verify that the file exists in the right folder, but it always returns a 404

I can remove the acme-challenge folder and make it again (or get win-acme v2.2.9 to create it automatically), with permissions 755. But that doesn't seem to help.

ampers.x10.mx/test.txt -> works
ampers.x10.mx/.well-known/test.txt -> works
ampers.x10.mx/.well-known/acme-challenge/test.txt -> gives a 404

My .htaccess file at the top has:

# Allow ACME challenge through
RewriteEngine On

# Skip all rewriting for ACME challenge requests
RewriteCond %{REQUEST_URI} ^/\.well-known/acme-challenge/ [NC]
RewriteRule ^ - [L]

RewriteCond %{REQUEST_URI} ^/.well-known/acme-challenge/ [NC]
RewriteRule ^ - [L]

Does LiteSpeed or directadmin somehow specifically block the acme-challenge folder? That would make external SSL validations via http-01 impossible to do, and I don't think we have access to the DNS validations method as I can't find those settings to tweak... Unless I am missing something...?

 

[mrburnsx]

win-acme is for Windows IIS Servers. These servers are not Windows.

 

[ampersx1]

win-acme is for Windows servers, but you can still roll an SSL cert and do the http-01 check with it - the following command line allows a pause for you to upload the challenge file before the check: wacs.exe --verbose --test --baseuri https://acme-v02.api.letsencrypt.org/

I can even get win-acme to place the challenge file in /domains/ampers.x10.mx/public_html/.well-known/acme-challenge but that file is then not accessible via the URL where it should live, eg http://ampers.x10.mx/.well-known/acme-challenge/C_718zUxzOrWO4SY04qPkczhYciuHr-27TVtAkmOtxI

Any thoughts on allowing any file to be visible in the /.well-known/acme-challenge/ folder, even if it is recreated with the correct permissions?

 

[mrburnsx]

I asked an admin but I do not think it will be possible as it becomes an internal pointer for ACME on the servers themselves.

I would use the DNS method if possible.

 

[ampersx1]

Hey thank you for your time in looking into this. I really do appreciate it.

I would love to be able to use the DNS method, but I couldn't find a place to do it in DirectAdmin (I could very well be blind and just not be seeing it in front of me).

But if there isn't access to edit the DNS, and if the files I drop in /.well-known/acme-challenge/ aren't publically viewable, then I have no idea how to get an SSL cert - unless I somehow know the right time to try via the automatic certificate function, which has a weekly limit of 200. (And I know this is not x10's fault at all, Lets Encrypt have imposed that limit).

 

[mrburnsx]

Hey thank you for your time in looking into this. I really do appreciate it.

I would love to be able to use the DNS method, but I couldn't find a place to do it in DirectAdmin (I could very well be blind and just not be seeing it in front of me).

But if there isn't access to edit the DNS, and if the files I drop in /.well-known/acme-challenge/ aren't publically viewable, then I have no idea how to get an SSL cert - unless I somehow know the right time to try via the automatic certificate function, which has a weekly limit of 200. (And I know this is not x10's fault at all, Lets Encrypt have imposed that limit).

Its in hosting control panel, Account Manager > DNS Management

 

[ampersx1]

I think you might see more than what I can.

Under Account Manager, I see:
- Domain Setup
- Subdomain Management
- SSL Certificates
- FTP Management
- Databases
- Domain Pointers
- Site Redirection
- Hotlinks Protection

And when I search for "DNS" in the Navigation filter, it doesn't give me any results.

When I go to E-mail Manger -> MX Records it says at the top of that page, MX Control Disabled, DNS Control Disabled

Thank you again for your time in helping me with this.

 

[Eric S]

I have re-enabled this option for your account. Can you please log out and back in which should then provide DNS management / control to you.

 

[ampersx1]

Eric S, mate, thank you very much. You have been super helpful, and I really appreciate all your help in solving this for me. Getting DNS management has helped me solve my issue in creating my own SSL certs.

Also, mrburnsx, thank you too for helping me with this problem and being patient with me.