# Apache “Redirect” and http-01 **URL:** \ **Category:** Client dev\ **Created:** [November 29, 2018, 8:40pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811 "2018-11-29T20:40:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![FGasper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fgasper/32/18787_2.png) [@FGasper](https://community.letsencrypt.org/u/FGasper)\ **Post date:** [November 29, 2018, 8:40pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/1 "2018-11-29T20:40:49Z")
Is there any way to teach Apache httpd to globally exempt `.well-known/acme-challenge/*` URL paths from `Redirect` directives? The END modifier to `RewriteRule` (new in httpd 2.4) achieves this effect for that directive, but I’ve been stumped to come up with a solution for the same exemption logic for `Redirect`. For example, if a user has `Redirect 302 / http://google.com/` in their `.htaccess` file, it’d be nice to have some way to teach Apache to ignore that directive if the URL is for an ACME challenge. Thank you! ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [November 29, 2018, 8:45pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/2 "2018-11-29T20:45:52Z")
Try `RedirectMatch 302 ^(?!/\.well-known/acme-challenge/).* https://google.com$0` ---
**Author:** ![FGasper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fgasper/32/18787_2.png) [@FGasper](https://community.letsencrypt.org/u/FGasper)\ **Post date:** [November 29, 2018, 8:47pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/3 "2018-11-29T20:47:07Z")
That assumes a direct modification to the .htaccess file. I want a global configuration that prevents httpd from following `Redirect` when it matches the ACME challenge pattern. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [November 29, 2018, 8:48pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/4 "2018-11-29T20:48:28Z")
Could you take a hint from the way Certbot does it, and just `Alias` `/.well-known/acme-challenge/` away from the user’s document root? ---
**Author:** ![FGasper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fgasper/32/18787_2.png) [@FGasper](https://community.letsencrypt.org/u/FGasper)\ **Post date:** [November 29, 2018, 8:50pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/5 "2018-11-29T20:50:49Z")
I haven’t tried that, but isn’t `Alias` just about filesystem mapping? I don’t see how that would prevent `Redirect` from gumming up the authz. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [November 29, 2018, 8:52pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/6 "2018-11-29T20:52:18Z")
> [@FGasper](#): > > filesystem mapping IIRC, in that case, the `.htaccess` file would never become involved, since the request is diverted before that point. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 29, 2018, 11:26pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/7 "2018-11-29T23:26:30Z")
A global alias precedes/overrides any vhost path manipulation. .htaccess controls would be applied from within the new path only. ---
**Author:** ![FGasper](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/fgasper/32/18787_2.png) [@FGasper](https://community.letsencrypt.org/u/FGasper)\ **Post date:** [November 30, 2018, 2:55pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/8 "2018-11-30T14:55:18Z")
Alias or AliasMatch _might_ work. I’d still prefer to find a less intrusive option that wouldn’t upend user expectations about where their stuff is. We’d have to document the change for customers, and it would break any custom setups users might have put in place … but we’ll check it out. Thank you! ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 30, 2018, 6:21pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/9 "2018-11-30T18:21:08Z")
The `.well-known/acme-challenge` folder is a very specific location; which should only be used by ACME clients. True, your clients may have used their specific acme-challenge locations in customized ways - but uncommon. So a “global alias” may be more than you require and, yes, it could impact some custom customer scripts… It seems that `mod_alias` can be used in the server config, virtual hosts, and directories ([https://httpd.apache.org/docs/2.4/mod/mod\_alias.html](https://httpd.apache.org/docs/2.4/mod/mod_alias.html)) So I would use it within your controlled vhost configs and include it as a common file (wherever needed). `` … `include /etc/apache2/common.challenges.location` … `` Where `/etc/apache/common.challenges.location` contains: `` `Alias "/common/challenge/folder"` `` ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [December 30, 2018, 6:21pm UTC](https://community.letsencrypt.org/t/apache-redirect-and-http-01/78811/10 "2018-12-30T18:21:10Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.