I can not create a certificate when using --webroot plugin

Help
21

We are not done testing :frowning:

2 Likes
22

go ahead. .sorry

1 Like
25

Ok that test passed - Hi back!

Now we need to simulate a more accurate challenge request.
Make the challenge path:
mkdir -p /var/www/scribblersathome/.well-known/acme-challenge/
then create the test file:
echo "test#2" > /var/www/scribblersathome/.well-known/acme-challenge/test2-file
then try it from the Internet:
http://scribblersathome.com/.well-known/acme-challenge/test2-file

2 Likes
26 
curl https://scribblersathome.com//.well-known/acme-ch
allenge/test2-file
test#2

 curl -Ii https://scribblersathome.com//.well-known/acm
e-challenge/test2-file
HTTP/2 200
etag: "7-63cb06df-89a24;;;"
last-modified: Fri, 20 Jan 2023 21:25:51 GMT
content-length: 7
accept-ranges: bytes
date: Fri, 20 Jan 2023 21:32:09 GMT
server: LiteSpeed
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"
; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, qu
ic=":443"; ma=2592000; v="43,46"
28

The problem is that you tested HTTPS - and that works.
But the request is via HTTP - and that fails!

curl https://scribblersathome.com/.well-known/acme-challenge/test2-file
test#2

curl -Ii http://scribblersathome.com/.well-known/acme-challenge/test2-file
HTTP/1.1 404 Not Found
date: Fri, 20 Jan 2023 21:38:13 GMT
server: LiteSpeed
connection: Keep-Alive
3 Likes
31

For the /.well-known/acme-challenge/ path, your HTTP isn't redirecting to HTTPS indeed, but other paths do. So some code in your OpenLiteSpeed must cause this specific behaviour for /.well-known/acme-challenge/ paths.

2 Likes
32

It only "worked" because that "double slash" did not match the exact challenge path and it was redirected to HTTPS [which works].

The correct path fails.
Because...
There is some code in the HTTP server block to handle challenge requests from some other root path [NOT /var/www/scribblersathome].

2 Likes
33

Can you try again please??

35

Bingo!

curl http://scribblersathome.com/.well-known/acme-challenge/test2-file
test#2

Now you can delete the test files.
I'd leave that path there OR it will have to be created and deleted (by certbot) for each renewal request.

2 Likes
36

It was not exactly a problem with the path, I only have one DocumentRoot path, the vhost need to add the listener for http/80 port. When you told me about http vs https I checked and added this listener.

Gracias Rudy y Osiris.

4 Likes
38

Then the HTTP was being served by the default block.
Which simply sent all HTTP to HTTPS [except challenge locations - which it sent elsewhere].
Another reason to keep port 80 open and each server block using it.

Cheers from Miami :beers:

2 Likes
39

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.