Home / server / Questions / 993323
In Process
Jay M
Asked: 2019-11-27 03:27:29 +0800 CST

How to have apache handle .well-known/acme-challenge and still have / passed to wsgi

  • 772

In order to support automatic LetsEncrypt certificate renewal certbot uses the --apache handler.

e.g.

certbot renew --apache

This handler installs a temporary VirtualHost for */.well-known/acme-challenge/ on the Apache server in order authenticate the renewal.

The problem is that this mechanism does not work if the existing virtual server uses HTTPS and Django over WSGI mounted on the http server root.

The temporary VirtualHost fails to capture the URL and so Django tries to service the request (and fails) as the URL is not in it's list of URLs.

apache2

1 Answers

  1. Writing the question made me think about how it works, so I then worked out the answer. As I could not find an answer to what must be a common issue I thought I'd post what I have found.

    There are other solutions, E.g. certbot-django and django-letsencrypt but both are fare more hastle than just letting the stock certbot handle it.

    The --apache certbot handler places it's files in /var/lib/letsencrypt/http_challenges, so all that is required is to have Apache handle those files in the same way as the docs recommend for static files.

    <VirtualHost *:443>

    [....SSL stuff]

    AliasMatch /.well-known/acme-challenge/(.*)$ /var/lib/letsencrypt/http_challenges/$1
    <directory /var/lib/letsencrypt/http_challenges>
      AllowOverride None
      Require all granted
    </directory>

    [....WSGI stuff]
WSGIScriptAlias / /opt/myserver/myapp/wsgi.py

</VirtualHost>
    • 4