# Letsencrypt Webroot Authentication Tested on Beta invited/whitelisted domain **URL:** \ **Category:** Issuance Tech\ **Created:** [October 27, 2015, 6:18pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276 "2015-10-27T18:18:44Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [October 27, 2015, 6:18pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/1 "2015-10-27T18:18:44Z")
Thanks for approving my beta application. I tested Letsencrypt Webroot Authentication on my CentOS 6.7 server and it works nicely for fully browser trusted SSL certificate on my [CentminMod LEMP stack](http://centminmod.com/) Nginx 1.9 HTTP/2 enabled web server [https://community.centminmod.com/posts/19914/](https://community.centminmod.com/posts/19914/) 🙂 FYI, CentOS/RHEL 6.x users need Python 2.7 [Redhat / CentOS 6.x users need python 2.7 - #3 by eva2000](https://community.letsencrypt.org/t/redhat-centos-6-x-users-need-python-2-7/2190/3) **What is Letsencrypt Webroot Authentication ?** > Authenticator plugin that performs SimpleHTTP challenge by saving necessary validation resources to appropriate paths on the file system. It expects that there is some other HTTP server configured to serve all files under specified web root > It was born out of the awesome work Kuba did with creating the [simplefs plugin](https://github.com/letsencrypt/letsencrypt/pull/757) which was later renamed to webroot authentication. In laymen terms, webroot authentication is an alternate way to obtain letsencrypt ssl certificates and pass the SimpleHTTP challenge by following these steps > 1. create a HTTPS base site before hand using self signed ssl certificate on apache or nginx - this site will have a public web root. This site domain also needs valid working DNS pointing to the server IP > 2. run letsencrypt webroot authentication method and pass your email address AND that site's public web root path to the command you run - this will perform automatically the the .well-known uri creation on the defined web root validating the domain you want the ssl certificate for On my Centmin Mod LEMP stack, you can auto generate a Nginx vhost with http and https vhost conf files via `centmin.sh menu option 2` (shell based menu) or via `nv` command line argument. ``` vhostname='le1.http2ssl.xyz' nv -d ${vhostname} -s y -u MYFTPUSERNAME ``` This would produce a web root path at `/home/nginx/domains/${vhostname}/public` which is passed on command line for Letsencrypt client's webroot authentication mode ``` vhostname='le1.http2ssl.xyz' /root/.local/share/letsencrypt/bin/letsencrypt --server https://acme-v01.api.letsencrypt.org/directory --renew-by-default -a webroot --webroot-path /home/nginx/domains/${vhostname}/public --email example@example.org --text --agree-tos --agree-dev-preview -d ${vhostname} auth ``` You'll end up with Letsencrypt SSL certificate where Nginx uses the fullchain.pem at `/etc/letsencrypt/live/le1.http2ssl.xyz/fullchain.pem`: ``` IMPORTANT NOTES: - If you lose your account credentials, you can recover through e-mails sent to example@example.org. - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/le1.http2ssl.xyz/fullchain.pem. Your cert will expire on 2016-01-25. To obtain a new version of the certificate in the future, simply run Let's Encrypt again. - Your account credentials have been saved in your Let's Encrypt configuration directory at /etc/letsencrypt. You should make a secure backup of this folder now. This configuration directory will also contain certificates and private keys obtained by Let's Encrypt so making regular backups of this folder is ideal. ``` ![](https://global.discourse-cdn.com/letsencrypt/original/2X/0/0940149640c240e559a8615ee388a1cf9aec1039.png) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/e/ecbbc0f1681e2c0b2bb3957e6d1838cd9a24bf0a.png) Not A+ as I have HSTS disabled as I test on both http and https usually. ![](https://global.discourse-cdn.com/letsencrypt/original/2X/b/ba18aad1909f7c4627fbb1f5e88b41c59e43c5d5.png) Nginx 1.9.6 HTTP/2 enabled web server compiled against LibreSSL 2.2.4 > nginx -V > nginx version: nginx/1.9.6 > built by clang 3.4.2 (tags/RELEASE\_34/dot2-final) > built with LibreSSL 2.2.4 > TLS SNI support enabled > configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D\_FORTIFY\_SOURCE=2 -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-c++11-extensions -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-http\_stub\_status\_module --with-http\_secure\_link\_module --with-openssl-opt=enable-tlsext --add-module=../nginx-module-vts --with-libatomic --with-threads --with-stream --with-stream\_ssl\_module --with-http\_gzip\_static\_module --add-module=../ngx\_pagespeed-release-1.9.32.10-beta --with-http\_sub\_module --with-http\_addition\_module --with-http\_image\_filter\_module --with-http\_geoip\_module --with-http\_realip\_module --add-module=../nginx-accesskey-2.0.3 --add-module=../nginx-http-concat-master --add-module=../ngx-fancyindex-ngx-fancyindex --add-module=../ngx\_cache\_purge-2.3 --add-module=../ngx\_devel\_kit-0.2.19 --add-module=../set-misc-nginx-module-0.29 --add-module=../echo-nginx-module-0.58 --add-module=../redis2-nginx-module-0.12 --add-module=../ngx\_http\_redis-0.3.7 --add-module=../lua-nginx-module-0.9.16 --add-module=../lua-upstream-nginx-module-0.03 --add-module=../lua-upstream-cache-nginx-module-0.1.1 --add-module=../nginx\_upstream\_check\_module-0.3.0 --add-module=../openresty-memc-nginx-module-4f6f78f --add-module=../openresty-srcache-nginx-module-ffa9ab7 --add-module=../headers-more-nginx-module-0.261 --with-pcre=../pcre-8.37 --with-pcre-jit --with-http\_ssl\_module --with-http\_v2\_module --with-openssl=../libressl-2.2.4 ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [October 27, 2015, 9:12pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/2 "2015-10-27T21:12:48Z")
@eva2000, thanks for all your help on the forum and congratulations on your successful certificate issuance! I’m glad it’s working for you. ---
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [October 27, 2015, 9:42pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/3 "2015-10-27T21:42:47Z")
thanks @schoen - very grateful to Kuba too - the webroot authentication IMHO is the best way for non-standard web servers to easily work with Letsencrypt for obtaining an SSL certificate as it's alot easier to get the web server/distro user's to come up with their own scripted https vhost generation before hand 😄 All webroot authentication plugin needs now is multi-domain/SANs support 🙂 Maybe this suggestion [SimpleFS plugin (fixes #742) by kuba · Pull Request #757 · certbot/certbot · GitHub](https://github.com/letsencrypt/letsencrypt/pull/757#issuecomment-142507415) > for multiple names, maybe allow multiple `--webroot-path` in an array and then if multiple `-d nameXX` are specified cycle through the `--webroot-path` array to check against the `-d name XX` values ? ---
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [October 31, 2015, 3:01pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/4 "2015-10-31T15:01:52Z")
Trying multi domain SAN SSL certificate via webroot authentication on CentminMod LEMP stack’s Nginx at [https://community.centminmod.com/posts/20018/](https://community.centminmod.com/posts/20018/). Thanks to @Leliana for the idea [Using the webroot domain verification method](https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7) 🙂 Of course some minor improvements suggested at [https://github.com/letsencrypt/letsencrypt/issues/1260](https://github.com/letsencrypt/letsencrypt/issues/1260) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/4/468de0f25dd66e2a0949114637551ed7642fe9da.png) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/6/66ed703cef69dae0451ffe40b1bc97de02b5447e.png) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/a/add794542a687f825fc644a6f5f3bb028747b8ed.png) ![](https://global.discourse-cdn.com/letsencrypt/original/2X/1/18cb8067ecfcf6f61a246bf007e78f702a4c63c2.png) ---
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [November 15, 2015, 10:27pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/5 "2015-11-15T22:27:41Z")
My latest progress with Letsencrypt webroot authentication integration into my [CentminMod.com LEMP web stack](http://centminmod.com/) [https://community.centminmod.com/posts/20509/](https://community.centminmod.com/posts/20509/) - full automation of Letsencrypt SSL certificate deployment via my nginx vhost generator 😃 centmin.sh menu options via shell ``` -------------------------------------------------------- Centmin Mod 1.2.3-eva2000.09 - http://centminmod.com -------------------------------------------------------- Centmin Mod Menu -------------------------------------------------------- 1). Centmin Install 2). Add Nginx vhost domain 3). NSD setup domain name DNS 4). Nginx Upgrade / Downgrade 5). PHP Upgrade / Downgrade 6). XCache Re-install 7). APC Cache Re-install 8). XCache Install 9). APC Cache Install 10). Memcached Server Re-install 11). MariaDB 5.2/5.5 & 10.x Upgrade Sub-Menu 12). Zend OpCache Install/Re-install 13). Install ioping.sh vbtechsupport.com/1239/ 14). SELinux disable 15). Install/Reinstall ImagicK PHP Extension 16). Change SSHD Port Number 17). Multi-thread compression: pigz,pbzip2,lbzip2... 18). Suhosin PHP Extension install 19). Install FFMPEG and FFMPEG PHP Extension 20). NSD Re-install 21). Update - Nginx + PHP-FPM + Siege 22). Add Wordpress Nginx vhost + WP Super Cache 23). Update Centmin Mod Code Base 24). Exit -------------------------------------------------------- Enter option [1 - 24] 2 -------------------------------------------------------- ``` and nginx vhost command line wizard ``` --------------------------------------------- Enter vhost domain name to add (without www. prefix): le10.http2ssl.xyz Create a self-signed SSL certificate Nginx vhost? [y/n]: y To get Letsencrypt SSL certificate, you must already have updated intended domain vhost name's DNS A record to this server's IP addresss. If top level domain, DNS A record is needed also for www. version of domain otherwise, Letsencrypt domain name validation will fail. le10.http2ssl.xyz is not a top level domain your server IP address: 104.152.214.220 current DNS A record IP address for le10.http2ssl.xyz is: 104.152.214.220 Abort this Nginx vhost domain setup to setup proper DNS A record(s) first? [y/n]: n Obtain Letsencrypt Free SSL certificate (90 day expiry / renew every 60 days) ? [y/n]: y ``` ![](https://global.discourse-cdn.com/letsencrypt/original/2X/3/39e1a6624da58440b46ddec6d5afa9775cce924f.png) ---
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [November 17, 2015, 6:25pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/6 "2015-11-17T18:25:34Z")
Official site outline of my Centmin Mod LEMP stack’s LE integration [http://centminmod.com/letsencrypt-freessl.html](http://centminmod.com/letsencrypt-freessl.html) 🕶 ---
**Author:** ![eva2000](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/eva2000/32/289_2.png) [@eva2000](https://community.letsencrypt.org/u/eva2000)\ **Post date:** [December 2, 2015, 8:39pm UTC](https://community.letsencrypt.org/t/letsencrypt-webroot-authentication-tested-on-beta-invited-whitelisted-domain/2276/7 "2015-12-02T20:39:59Z")
Still working on Letsencrypt integration into my Centmin Mod LEMP stack installer. Just started testing my [Wordpress auto installer routine](http://centminmod.com/nginx-wordpress-installer.html) which now adds Letsencrypt SSL support. So you can auto install Wordpress + WP Plugins + Nginx HTTP/2 SSL via Letsencrypt altogether [https://community.centminmod.com/posts/21328/](https://community.centminmod.com/posts/21328/) 🙂