I have a peculiar situation: it seems that any request to the path /.well-known/acme-challenge/ gets dropped (never arrives at the target web server). But anything to /.well-known/ works OK. This only happens on HTTP/80. Using HTTPS/443 works correctly (obviously, LE requires HTTP/80, that's not …

It could be a firewall - recently we've seen that Palo Alto has implemented an acme-protocol type and seems to drop those requests (by default). It could be a poorly written/executed location (or location-match) statement. It could be other stuff ... We would need more information to better help …

[image] flintg: My next theory is that it's happening at the perimeter firewall, which we can't access or control. I've never seen a firewall that behaves like that, but I don't know what I don't know. This is almost certainly a Palo Alto firewall. Their default settings started blocking thes…

Hard to say for certain; As the "test" URL doesn't show what user-agent was being used. For all we know, there is another system (in-line) that is handling all the ACME challenge requests.

Yeah, I agree with Rudy and Peter this is most likely a Palo Alto Networks firewall causing a problem. We have seen several different symptoms from their recent (last few months) changes to their default rules. The first set of symptoms is shown here: [image] Renewal failure: "Con…

[image] flintg: My next theory is that it's happening at the perimeter firewall, which we can't access or control. Well, then your next step is to contact whoever can review the firewall logs and update its' policy.

/.well-known/acme-challenge/<challenge> does not make it to the web server; /.well-known/<challenge> does - has anyone seen this before?

Help

petercooperjr July 12, 2022, 2:01am 3

This is almost certainly a Palo Alto firewall. Their default settings started blocking these requests in that sort of way a few months ago.

Topic		Replies	Views
Http-01 fails even with acme-challenge file accessible Server	5	2468	September 1, 2016
Failed authorization procedure .well-known/acme-challenge Help	7	1186	September 28, 2018
Issueing fails: Could not connect to	0	1333	January 23, 2016
.NET Core win-acme .well-known/acme-challenge Authorization invalid Ayuda (en Español)	7	1782	February 28, 2021
Again reset by peer Help	6	941	May 11, 2022

/.well-known/acme-challenge/<challenge> does not make it to the web server; /.well-known/<challenge> does - has anyone seen this before?

Related topics