Issue pki-validation folder returns 404 on new server

[MarkDale]

Hello Folks,

I have just migrated to a new Plesk Obsidian server.
All is going well except when I try to browse to any file in the /.well-known/pki-validation/ folder I get a 404 error.
Files in /.well-known/ load fine.
The errors in the Logs are below


The behaviour is the same across all sites in all subscriptions - so I assume is some server configuration / permission setting that I have missed - but can't find anything in settings or any related problems on chat forums.

Any help sincerely welcome.

Thanks!

 

[elseone_arvind]

I'm having the same issue since yeasterday

 

[Jose Isla]

Same error since today morning... please any solution ????
Plesk 18.0.40 update 1

 

[elseone_arvind]

@Jose Isla ,

It may look foolish but,
would you please try to create the same verification file under/var/www/vhosts/default/htdocs/.well-known/pki-validation/youfile.txt and try to verify it once again?

Note: If the folder does not exist /var/www/vhosts/default/htdocs/.well-known/pki-validation please crete it

root cause: use-common-challenge-dir

 

[Jose Isla]

works! Thanks!!!! @elseone_arvind
But what has changed so that before, a few weeks ago, it did not give an error when validating certificates?

 

[MarkDale]

Many thanks for teh response - I will test it shortlly

@Jose Isla ,

It may look foolish but,
would you please try to create the same verification file under/var/www/vhosts/default/htdocs/.well-known/pki-validation/youfile.txt and try to verify it once again?

Note: If the folder does not exist /var/www/vhosts/default/htdocs/.well-known/pki-validation please crete it

root cause: use-common-challenge-dir

Many thanks for the response, I will test it shortly.

It seems to present a challenge, as not all site owners will have access to this directory.

I notice the comment at the foot of your reply that states root cause: use-common-challenge-dir

From my limited research this seems to be a Let's Encrypt setting - which I imagine would affect the acme-challenge directory.

Could it affect the pki-validation directory as well? And should we be finding this setting and changing it to false?

Many thanks again for your help with this

Mark

 

[plesk0]

Hello Folks,

I have just migrated to a new Plesk Obsidian server.
All is going well except when I try to browse to any file in the /.well-known/pki-validation/ folder I get a 404 error.
Files in /.well-known/ load fine.
The errors in the Logs are below
View attachment 19898

The behaviour is the same across all sites in all subscriptions - so I assume is some server configuration / permission setting that I have missed - but can't find anything in settings or any related problems on chat forums.

Any help sincerely welcome.

Thanks!

Did you fix it?

Exactly the same issue
Files in /.well-known/ works

But
Files in /.well-known/pki-validation
404 Not Found
nginx

@Jose Isla ,

It may look foolish but,
would you please try to create the same verification file under/var/www/vhosts/default/htdocs/.well-known/pki-validation/youfile.txt and try to verify it once again?

Note: If the folder does not exist /var/www/vhosts/default/htdocs/.well-known/pki-validation please crete it

root cause: use-common-challenge-dir

Tried it but it didn't work.

 

[patrick-11]

In my case it happened after i enabled extension sectigo.
Disable extension sectigo or remove sectigo config in special domain 's nginx conf. Restart nginx with "service nginx restart" command.

Ex: /etc/nginx/plesk.conf.d/vhosts/yourdomain.conf
#extension sectigo begin
location ^~ /.well-known/pki-validation/fileauth.txt {
try_files $uri $uri/ =404;
}

location ^~ /.well-known/pki-validation/ {
root /var/www/vhosts/default/htdocs;

types { }
default_type text/plain;

satisfy any;
auth_basic off;
allow all;

location ~ ^/\.well-known/pki-validation.*/\. {
deny all;
}
}
#extension sectigo end

 

[jmcouillard]

Hi,

This is usually an issue with the Sectigo SSL exension. Sectigo SSL extension is blocking any web request to get to files under /.well-known/pki-validation.

To solve that, login to Plesk, go to the Extensions tab, select My Extensions and disable Sectigo SSL extension.

Disabling the extension doesn't recreate the server configuration file, in which the problematic lines are stored. So you will need te recreate the webserver configuration for the concerned domain(s). To do so, login to your Plesk server using SSH and run the following command (make sure to login with an account that allow you to use the Plesk CLI) :

plesk repair web -server example.com

where example.com is the domain name with the validation issue.

Files under /.well-known/pki-validation should now be accessible.

 

[Kroptokin]

Hi,

This is usually an issue with the Sectigo SSL exension. Sectigo SSL extension is blocking any web request to get to files under /.well-known/pki-validation.

To solve that, login to Plesk, go to the Extensions tab, select My Extensions and disable Sectigo SSL extension.

Disabling the extension doesn't recreate the server configuration file, in which the problematic lines are stored. So you will need te recreate the webserver configuration for the concerned domain(s). To do so, login to your Plesk server using SSH and run the following command (make sure to login with an account that allow you to use the Plesk CLI) :


where example.com is the domain name with the validation issue.

Files under /.well-known/pki-validation should now be accessible.

Hi - thank you very much. This worked for me.

 

[Kroptokin]

I don't know if anyone from Plesk ever reads these forums but I would just say - did you test this? did you know about this? was it deliberate? i can't speak for others but this issue cost me 2 hours. Using this folder seems pretty standard. yet it is blocked out of the box in a mysterious way. Today I had one of those surveys pop up - would you recommend Plesk? No. How could I?

The answer seems to be the one provided by jmcouillard above

 

[Nik G]

hello everyone.

there are possible workarounds below:

• Disable common challenge dir
  
  

  plesk ext sslit --common-challenge-dir -disable

  
  
• Use explicit additional Nginx directive in Apache & nginx Settings of the domain, something like
  
  

  location = /.well-known/pki-validation/ {

  alias /var/www/vhosts/<your_domainSpaceDir_here>/httpdocs/.well-known/pki-validation/;

  }

 

[jmcouillard]

On an other server that was using nginx Proxy mode, I needed to do the steps above AND add the following additional nginx directives :

location ~ /.well-known {
allow all;
}

location ~ /.well-known/pki-validation {
allow all;
}

 

[DGuck23]

Still having this issue in 2024.

I have 2 files in /.well-known/pki-validation/ and one loads, the other doesn't.

Very frustrating!

 

[Sebahat.hadzhi]

Hey, @DGuck23. Have you tried the workaround suggested by @Nik G in the previous comment? If the Common Challenge Directory feature is already disabled and you tried adding the NginX directive, you might also try the workaround from the following article. If that doesn't help either, please consider submitting a ticket to our support team so they can further investigate the case.

 

[Sebahat.hadzhi]

@DGuck23, would you mind also sharing whether you are trying to install Let's Encrypt or there is another end goal? Thank you in advance.