Site Redirection probhits Lets Encrypt to verificate site with NGINX, check solution here

[Tapeix]

Lets Encrypt cannot verify the domain when Site Redirection is set. This is because NGINX does not set a specific directory (root dir) for the acme challenge. As a result, Lets Encrypt is redirected to the Site Redirection URL, which does not display the verification file; thus, Lets Encrypt is failing to process the SSL certificate.

How to reproduce:
> Create hosting package
> Setup site redirection (e.g. google.nl > google.com)
> Request SSL certificate (e.g. google.nl)

Problem:
NGINX does not point to a specific directory for the /well-known/acme-challenge.

Solution
Add the following lines:

location ^~ /.well-known/acme-challenge/ {
    root |DOCROOT|/.well-known/acme-challenge/;
    default_type "text/plain";
    allow all;
  }

Under the following lines:

root |DOCROOT|;

index index.php index.html index.htm;

In the following NGINX vhost files:

/usr/local/directadmin/data/templates/custom/nginx_server_secure.conf
/usr/local/directadmin/data/templates/custom/nginx_server.conf

Then run:

/usr/local/directadmin/custombuild/build rewrite_confs

 

[Tapeix]

For anyone wondering what error I was getting, this is the debug log:

2022/08/11 11:55:36 [INFO] [google.nl] acme: Obtaining SAN certificate
2022/08/11 11:55:36 [INFO] [google.nl] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/140803998647
2022/08/11 11:55:36 [INFO] [google.nl] acme: Could not find solver for: tls-alpn-01
2022/08/11 11:55:36 [INFO] [google.nl] acme: use http-01 solver
2022/08/11 11:55:36 [INFO] [google.nl] acme: Trying to solve HTTP-01
2022/08/11 11:55:43 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/140803998647
2022/08/11 11:55:44 Could not obtain certificates:
    error: one or more domains had a problem:
[google.nl] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 18.192.233.222: Invalid response from https://google.com/: "

(*) I renamed the customer domain to Google.

 

[Tapeix]

In case this fix is not working for you, please make sure letsencrypt=2 is set in DirectAdmin config.

/usr/local/directadmin/./directadmin set letsencrypt 2
systemctl restart directadmin

Ref. https://www.directadmin.com/features.php?id=1828