I have Apache 2.4 and the following site-config for acme challenges:

<IfModule mod_alias.c>
    Alias /.well-known/acme-challenge /var/www/letsencrypt/challenges/

    <Directory "/var/www/letsencrypt/challenges/">
        Options -Indexes

<IfModule mod_rewrite.c>
    #Redirect before other rewrite rules
    RewriteCond %{REQUEST_URI} /\.well\-known/acme\-challenge/
    RewriteRule (.*) /.well-known/acme-challenge/$1 [L,QSA]

The file is linked in sites-enabled as 000-acme-challenge.conf so it will have first priority over all others. It only seem to work for sub-/domains where PHP is running as FPM, not where e.g. GitWeb is running as CGI.

Strange, as e.g. my GitWeb (publicly accessible) is linked as 010-git.conf which should load it after 000 (right?).

Plus I get a rate-limit error 429 for some sites. Maybe I have to wait some time there. ;-)

All sub-/domains run as VirtualHost btw., including GitWeb.


I had permanent redirects from port 80 to 443 (with LetsEncrypt certs) which is generally a good idea when there is a HTTPS version around. These redirects caused the certificate not to be validated (of course).

A bit of a help with this stackoverflow answer (by Cherry) I was able to have both redirect and came up with this:

<IfModule mod_alias.c>
    <VirtualHost f.haeder.net:80>
        ServerName f.haeder.net
        ServerAlias f.haeder.net
        RedirectMatch permanent ^(?!/.well-known/acme-challenge/).* https://f.haeder.net/

This is what I'm using on my Friendica node and as you can test for yourself, it works perfectly. Just to share this little piece of config. :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.