.well-known issue on Bitnami apache

rcecinati · December 7, 2017, 6:51pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: demo.bigopen.eu

I ran this command:sudo /tmp/certbot/certbot-auto certonly --webroot -w /opt/tomcat/apache-tomcat/webapps/ROOT/ -d demo.bigopen.eu

It produced this output:Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Cert is due for renewal, auto-renewing…
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for demo.bigopen.eu
Using the webroot path /opt/tomcat/apache-tomcat/webapps/ROOT for all unmatched domains.
Waiting for verification…
Cleaning up challenges
Unable to clean up challenge directory /opt/tomcat/apache-tomcat/webapps/ROOT/.well-known/acme-challenge
Failed authorization procedure. demo.bigopen.eu (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://demo.bigopen.eu/.well-known/acme-challenge/xdHTnN6bNePQY5llSAgnGHI44YDfg8kOnYHkU3N_Dqo: “Apache Tomcat/8.0.38 - Error reportH1 {font-family:Tahoma,Arial”

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: demo.bigopen.eu
Type: unauthorized
Detail: Invalid response from
http://demo.bigopen.eu/.well-known/acme-challenge/xdHTnN6bNePQY5llSAgnGHI44YDfg8kOnYHkU3N_Dqo:
“Apache Tomcat/8.0.38 - Error
reportH1 {font-family:Tahoma,Arial”

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

My web server is (include version): Apache Tomcat/8.0.38

The operating system my web server runs on is (include version):Ubuntu 14.04 LTS

My hosting provider, if applicable, is: Amazon EC2

I can login to a root shell on my machine (yes or no, or I don’t know):yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):no

The problem seems to get for my browser (and for acme) anything from a “.well-known” subdir (acme-challenge in this case). If I manually put a file in another sibling “well-known” directory(without trailing dot) I can read it from my browser.
The weird thing is that I already succeedeed once, and the correct certs were generated and installed (thru webroot option). Now, at the time of renewing, I got this
strange behavior. The tricky policy of Bitnami Apache does not help.
Should I better ask the Bitnami people?
I already crawled thru this community but I could not find any similar case.
Thank you good willing men

jsha · December 7, 2017, 6:57pm

I think that's a good start. You can also share your apache configs here, and check for any ".htaccess" files that might be setting policies to not serve dotfiles.

rcecinati · December 7, 2017, 8:37pm

dear jsha,
thank you for your reply.
I cannot find .htaccess files in the significant part of my file system (looking for -la option of course). Nonethe less I am ignorant about .htaccess usage.
Here is what is supposed to be the main .conf file in Bitnami realm, that is
/opt/tomcat/apache2/conf/bitnami/bitnami.conf:

# Default Virtual Host configuration.

<IfVersion < 2.3 >
  NameVirtualHost *:80
  NameVirtualHost *:443
</IfVersion>

<VirtualHost _default_:80>
  DocumentRoot "/opt/tomcat/apache2/htdocs"
  <Directory "/opt/tomcat/apache2/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride All
    <IfVersion < 2.3 >
      Order allow,deny
      Allow from all
    </IfVersion>
    <IfVersion >= 2.3 >
      Require all granted
    </IfVersion>
  </Directory>


  # Error Documents
  ErrorDocument 503 /503.html

  # Bitnami applications installed with a prefix URL (default)
  Include "/opt/tomcat/apache2/conf/bitnami/bitnami-apps-prefix.conf"
</VirtualHost>

# Default SSL Virtual Host configuration.

<IfModule !ssl_module>
  LoadModule ssl_module modules/mod_ssl.so
</IfModule>

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:/opt/tomcat/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

<VirtualHost _default_:443>
  DocumentRoot "/opt/tomcat/apache2/htdocs"
  SSLEngine on
#SSLCertificateFile "/opt/tomcat/apache2/conf/server.crt"
SSLCertificateFile "/etc/letsencrypt/live/demo.bigopen.eu/fullchain.pem"
SSLCertificateKeyFile "/etc/letsencrypt/live/demo.bigopen.eu/privkey.pem"
#SSLCertificateKeyFile "/opt/tomcat/apache2/conf/server.key"

  <Directory "/opt/tomcat/apache2/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride All
    <IfVersion < 2.3 >
      Order allow,deny
      Allow from all
    </IfVersion>
    <IfVersion >= 2.3 >
      Require all granted
    </IfVersion>
  </Directory>

  # Error Documents
  ErrorDocument 503 /503.html

  # Bitnami applications installed with a prefix URL (default)
  Include "/opt/tomcat/apache2/conf/bitnami/bitnami-apps-prefix.conf"
</VirtualHost>

# Bitnami applications that uses virtual host configuration
Include "/opt/tomcat/apache2/conf/bitnami/bitnami-apps-vhosts.conf"

I am aware that the
DocumentRoot "/opt/tomcat/apache2/htdocs"
is NOT the root dir under which I expect the .well-known stuff to be dropped, i.e.
/opt/tomcat/apache-tomcat/webapps/ROOT/
but the latter is what is actually used by bitnami apache. I still can’t understand the way it works, but it works.

Any hint?

jsha · December 7, 2017, 9:25pm

It seems like this (and the other includes) might be the key to your problem, along with the difference between /opt/tomcat/apache2/htdocs and /opt/tomcat/apache-tomcat/webapps/ROOT, as you point out.

I'd recommend trying the Apache plugin for certbot: certbot --apache.

rcecinati · December 8, 2017, 8:48am

Here are the includes:

$ cat apache2/conf/bitnami/bitnami-apps-prefix.conf

Bitnami applications installed in a prefix URL

Include “/opt/tomcat/apps/phpmyadmin/conf/httpd-prefix.conf”

$ cat /opt/tomcat/apps/phpmyadmin/conf/httpd-prefix.conf
Alias /phpmyadmin/ "/opt/tomcat/apps/phpmyadmin/htdocs/"
Alias /phpmyadmin “/opt/tomcat/apps/phpmyadmin/htdocs”

Include “/opt/tomcat/apps/phpmyadmin/conf/httpd-app.conf”

$ cat /opt/tomcat/apps/phpmyadmin/conf/httpd-app.conf

AuthType Basic

AuthName phpMyAdmin

AuthUserFile “/opt/tomcat/apache2/users”

Require valid-user

AllowOverride None

php_value upload_max_filesize 80M
php_value post_max_size 80M

<IfDefine USE_PHP_FPM>
   <FilesMatch \.php$>
     SetHandler "proxy:fcgi://phpmyadmin-fpm"
   </FilesMatch>
</IfDefine>

<IfVersion < 2.3 >
Order allow,deny
Allow from 127.0.0.1
Satisfy all

= 2.3>
Require local

ErrorDocument 403 “For security reasons, this URL is only accessible using localhost (127.0.0.1) as the hostname.”

Include “/opt/tomcat/apps/phpmyadmin/conf/htaccess.conf”

$ cat /opt/tomcat/apps/phpmyadmin/conf/htaccess.conf
<Directory “/opt/tomcat/apps/phpmyadmin/htdocs/test”>

This folder does NOT need to be accessible over HTTP

In most cases the tests included here will be run from a command line interface.

(the following directive denies access by default)

For more information see: http://httpd.apache.org/docs/current/mod/mod_authz_host.html#allow

Order allow,deny

_______________________________________________

At this point, I got lost. Nothing seems to redirect from :
/opt/tomcat/apache2/htdocs
to:
/opt/tomcat/apache-tomcat/webapps/ROOT

jmorahan · December 8, 2017, 9:05am

Did you miss this one?

rcecinati · December 8, 2017, 9:25am

Here’s to you (but it’s empty)

$ cat /opt/tomcat/apache2/conf/bitnami/bitnami-apps-vhosts.conf

Bitnami applications installed in a Virtual Host

rcecinati · December 8, 2017, 10:00am

first of all, I want to thank jmorahan and jsha for their precious support and help.
I overcame the problem observing in Tomcat Manager, a console I normally do not use, that the links to applications and services are originated under
/opt/tomcat/apache-tomcat/webapps

and not under
/opt/tomcat/apache-tomcat/webapps/ROOT/

So, I relaunched the certbot-auto with the --webroot option pointing to the correct root and it worked. (it just couldn’t flush the acme-challenge directory, but it wrote into it anyway)
Still don’t know the trick Bitnami uses to bounce the document root away, I will further investigate.

system · January 7, 2018, 10:00am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.