• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion

Issue Installing LetsEncrypt certificate for forward hosting fails initially

N

Not_allowed_to_use_email

New Pleskian
Using Plesk Obsidian 18.0.28 Update 3.
The changelog for SSL It! 1.5.0 "17 July 2020" says:
"Domains with the “Forwarding” hosting type can now be secured via SSL It! with certificates from Let’s Encrypt. The feature works in Plesk Obsidian for Linux with the Let’s Encrypt extension version 2.11 and later."

Adding a new domain to a subscription
Setting this domain as forwarding hosting
Activate SSL support in hosting settings
Requesting a letsencrypt certificate will fail with "Token not available"
http://<domain>/.well-known/acme-challenge/WkPHmm1bB8llHJDrSZk9C3v9GDqLH2SNwkjYJkSbsSY

Looking in the config file in /etc/apache2/plesk.conf.d/forwarding
i see a "RedirectPermanent / ...."
and some Alias / Location stuff for letsencrypt.

Clicking the token link forwards me to the destination domain, seems forwarding always happens.

Now if you look in the apache2 docs, you read "Redirect directives take precedence over Alias and ScriptAlias directives"


Then I replaced the RedirectPermanent lines with
RedirectMatch Permanent "^(/(?!\.well-known/acme-challenge/).*)" <traget>
and suddenly the new certificate was installed!

Very strange: After installing the letsencrypt certificate successfully for the one single time, the forwarding_http.conf file gets rebuilt with
RedirectPermanent statements, but then reissuing the certificate seems to work ?!?!
 
Works for me after "plesk repair web" for this particular domain.
Before repair the config-file contains no exemps for the acme-challenges. plesk web repair-tool added this parameters to config-file successfully.
 
I just tried that .. no changes to conf-files.

in the .conf-file for the domain in /etc/apache2/plesk.conf.d/forwarding I have a line
RedirectPermanent / "<destination>"
and below
#extension letsencrypt begin
Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"

the docs for apache 2.4 mod_alias state:
Order of Processing
First, all Redirects are processed before Aliases are processed, and therefore a request that matches a Redirect or RedirectMatch will never have Aliases applied.


This is exactly what I experience ....
 
Not_allowed_to_use_email said:
I just tried that .. no changes to conf-files.

in the .conf-file for the domain in /etc/apache2/plesk.conf.d/forwarding I have a line
RedirectPermanent / "<destination>"
and below
#extension letsencrypt begin
Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"

the docs for apache 2.4 mod_alias state:
Order of Processing
First, all Redirects are processed before Aliases are processed, and therefore a request that matches a Redirect or RedirectMatch will never have Aliases applied.


This is exactly what I experience ....
Click to expand...

My config looks same as you state.

It is working like a charm.

Code: 
 RedirectPermanent / "<----TARGET URL---->"

        #extension letsencrypt begin
        Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"

        <Location /.well-known/acme-challenge/>
                # Require all granted
                Order Deny,Allow
                Allow from all
                Satisfy any
        </Location>

        <LocationMatch "^/.well-known/acme-challenge/(.*/|)\.">
                # Require all denied
                Order Allow,Deny
                Deny from all
        </LocationMatch>
        #extension letsencrypt end
 
I have the same issue. Lets Encrypt validation fails (when using file verification). cURL confirms.

Code: 
# curl http://X.com/.well-known/acme-challenge/y0mtafXXVNQ0CXE6bw9HBATpBhtRV0LSm1ut35v-9l4
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https://redirected.to/site/.well-known/acme-challenge/y0mtafXXVNQ0CXE6bw9HBATpBhtRV0LSm1ut35v-9l4">here</a>.</p>
<hr>
<address>Apache Server at X.com Port 80</address>
</body></html>

Vhost configuration for the domain is:

Code: 
<VirtualHost x.y.z.a:80 >
  ServerName "x.com"
  ServerAlias "www.x.com"
  ServerAlias "ipv4.x.com"

  <IfModule mod_ssl.c>
    SSLEngine off
  </IfModule>

  RedirectPermanent / "https://redirected.to/site/"

  #extension letsencrypt begin
  Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"

  <Location /.well-known/acme-challenge/>
    # Require all granted
    Order Deny,Allow
    Allow from all
    Satisfy any
  </Location>

  <LocationMatch "^/.well-known/acme-challenge/(.*/|)\.">
    # Require all denied
    Order Allow,Deny
    Deny from all
  </LocationMatch>
  #extension letsencrypt end

  #extension sslit begin

  #extension sslit end

</VirtualHost>

Tried rebuilding configuration files, doesn't matter. Generates the same output.
When I comment out the RedirectPermanent line the validation succeeds. But obviously there is no redirect anymore.
 
The Bug is still existing!!!

on Apache 2.4 "RedirectPermanent" happens first and so the lets-encrypt token can never be accessed.

"Token for authorization is not available at http://<orig-domainname>/.well-known/acme-challenge/GQ-WLfkqqWGbQLIySyLUPSkpj8yIOiA7srok65XSwjs"
... and also https://<orig-domainname>/.well-known/acme-challenge/GQ-WLfkqqWGbQLIySyLUPSkpj8yIOiA7srok65XSwjs


Excluding the auth-token from redirecting fixes the problem:
change (2 times)
RedirectPermanent / "<target>"
to
RedirectMatch Permanent "^(/(?!\.well-known/acme-challenge/).*)" "<traget>"


This problem is now open for more than half a year !!! C'mon plesk, please fix it!
 
Last edited:
You must log in or register to reply here.

Similar threads

D
Issue Lets Encrypt Not Successful over port 80
Replies
8
Views
371
Daiv
D
J
Issue Error when renewing SSL certificate
Replies
1
Views
510
Peter Debik
P
Nextgen-Networks
Issue Lets Encrypt - error in certificate renew process
2
Replies
21
Views
2K
Peter Debik
P
D
Issue certificate of VPS host still used after SSL configuration for newly added domain
Replies
4
Views
632
deepnpisgah
D
T
Issue Unable to install Let's Encrypt certificate for temporary domain
Replies
5
Views
2K
Peter Debik
P
Back
Top