# 503 Error with Apache Reverse Proxy **URL:** \ **Category:** Help\ **Created:** [September 9, 2019, 7:09pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654 "2019-09-09T19:09:26Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![bholland](https://avatars.discourse-cdn.com/v4/letter/b/46a35a/32.png) [@bholland](https://community.letsencrypt.org/u/bholland)\ **Post date:** [September 9, 2019, 7:09pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/1 "2019-09-09T19:09:26Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [vault.legacyknights.org](http://vault.legacyknights.org) It produced this output: 503 Unavailable server * * * I am setting up an on-prem password manager which uses an install script that includes Letsencrypt. I already have a CentOS 7 Apache reverse proxy handling several other domains to several backend servers. My reverse proxy already is running Letsencrypt, with the SSL folders mapped to one of the backend web servers in order to use the certificates. This new password manager server I am setting up runs Letsencrypt during the install script, so I can’t duplicate what I’ve done before. It almost acts like the return request on port 80 is stopping at the proxy, even though I have the config setup to not do that. Here is my **edited** virtual host config on my reverse proxy, any ideas? \ ServerAdmin [support@legacyknights.org](mailto:support@legacyknights.org) ProxyPreserveHost on ``` ServerName vault.legacyknights.org ErrorLog logs/error.log CustomLog logs/access.log combined LogLevel error ProxyPass http://x.x.x.x/ ProxyPassReverse http://x.x.x.x/ Order allow,deny Allow from outbound1.letsencrypt.org Allow from outbound2.letsencrypt.org ProxyRequests on ``` ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [September 9, 2019, 7:20pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/2 "2019-09-09T19:20:07Z")
Hi @bholland that's > [@bholland](#): > > ```nohighlight > > > ``` a closed element, so the location definition is empty. Use ```nohighlight ``` ---
**Author:** ![JamesLE](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jamesle/32/49364_2.png) [@JamesLE](https://community.letsencrypt.org/u/JamesLE)\ **Post date:** [September 9, 2019, 7:21pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/3 "2019-09-09T19:21:10Z")
Hi, @bholland, Unfortunately, just allowing outbound1 and outbound2 won’t work for our staging environment, and might also be a problem with our production environment in the future. This is because of our [multiple vantage point validation rollout](https://community.letsencrypt.org/t/validating-challenges-from-multiple-network-vantage-points/40955). ---
**Author:** ![bholland](https://avatars.discourse-cdn.com/v4/letter/b/46a35a/32.png) [@bholland](https://community.letsencrypt.org/u/bholland)\ **Post date:** [September 9, 2019, 8:05pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/4 "2019-09-09T20:05:56Z")
Thank you for your reply. Unfortuantely Apache won’t let me make that change. I must have at least the forward slash otherwise it errors when applying the config. ---
**Author:** ![bholland](https://avatars.discourse-cdn.com/v4/letter/b/46a35a/32.png) [@bholland](https://community.letsencrypt.org/u/bholland)\ **Post date:** [September 9, 2019, 8:06pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/5 "2019-09-09T20:06:49Z")
JamesLE, are there other FQDNs that I and add to that list? I don’t want a flood of attempts on port 80 to that server, I want to restrict it for only Letsencrypt. ---
**Author:** ![JamesLE](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jamesle/32/49364_2.png) [@JamesLE](https://community.letsencrypt.org/u/JamesLE)\ **Post date:** [September 9, 2019, 8:09pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/6 "2019-09-09T20:09:41Z")
Unfortunately not: I don’t think we’re planning to publish a predictable list of endpoints. What I usually do is restrict untrusted IPs to /.well-known/acme-challenge, which should only contain harmless static files. For high-security deployments, the DNS-01 challenge might be a good alternative. ---
**Author:** ![bholland](https://avatars.discourse-cdn.com/v4/letter/b/46a35a/32.png) [@bholland](https://community.letsencrypt.org/u/bholland)\ **Post date:** [September 9, 2019, 8:26pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/7 "2019-09-09T20:26:39Z")
OK, I don’t know yet why this worked, but I commented out the entire section, and moved the Proxypass lines outside of it. I did add a forward slash before http. ```auto ProxyPass / http://x.x.x.x/ ProxyPassReverse / http://x.x.x.x/ ``` Letsencrypt was successfull in establishing a certificate. Thank you everyone for your help! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 9, 2019, 8:33pm UTC](https://community.letsencrypt.org/t/503-error-with-apache-reverse-proxy/101654/8 "2019-10-09T20:33:26Z")
Closed on October 9, 2019, 8:33pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.