Topic: mod_md : not possible to use with other acme client

[pbhq]

Split from www.apachelounge.com/viewtopic.php?t=7938

[admin]

I run here mod_ssl and not with mod_md. Cannot test with win-acm now, have to wait for cert expire.


I think you mean with win-acme client.

Maybe the author Stefan can answer if .well-know is catched in mod_ssl with and without mod_md ?

When it is true what you say then in the Linux world they could maybe not use their Certbot client either.

I would like to see that a Linux users tries it ?

Maybe you yo file a bug report when Linux also has issues at https://bz.apache.org/bugzilla/ is preferred by the dev's.

Posted this again to the dev list: http://apache-http-server.18135.x6.nabble.com/mod-md-not-possible-to-use-Lets-Encrypt-Win-Simple-td5042358.html

[glsmith]

[Steffen]

He means that he cannot run win-acm to get certs, because the challenge in .well-know dir is catched by mod_ssl.

I think he is using the TLS-SNI challenge with an old account ? TLS-SNI challenge was disabled by Let's Encrypt back in January, but old users can still use it.

@pbhq what happens when you remove the md folder and start all over again ?

@pbhq what happens when you create a new certificate with win-acm without mod_md and with the mod_ssl ?

[Steffen]

Did a test by making: .well-known\acme-challenge\test.txt

Running not with mod_md :
https://www.apachelounge.com/.well-known/acme-challenge/test.txt

Gives no errors.

[Steffen]

Running with mod_md gives:

not found:

GET /.well-known/acme-challenge/test.txt HTTP/1.1" 404

So when running mod_md you cannot run a acme client which uses https for a challenge.

[pbhq]

[Steffen]

This was the log with mod_md:

mod_md.c(1317): [client 2001:980:a510:1:c5e7:56f7:9d:ab36:65315] Challenge for www.apachelounge.com (/.well-known/acme-challenge/test.txt)

[glsmith]

OK, I'd imagine that is by design.

Where does mod_md store the well_known stuff? In wherever you have set MDStoreDir. So "${MDStoreDir}/domain" IIRC.

Where does win-acme store the well_known stuff?
"${DocumentRoot}/.well-known/acme-challenge/" IIRC when trying it out long ago under it's original name.

Those are two different places and I would assume that mod_md intercepts any URI with .well-known/acme-challenge/ in it and has Apache serve what's in "${MDStoreDir}/domain" instead.

Like an built-in Alias "/.well-known/acme-challenge/" "${MDStoreDir}/${HTTP_HOST}/"

You yourself had mod_ssl running without mod_md in your first test so mod_ssl will work without mod_md loaded and that is what the OP said did not and I disagreed with. If you have mod_md directives in your config not surrounded by an IfModule container/s, then Yes, mod_ssl, actually Apache, will not start w/o mod_md loaded.

Just my take what was originally stated, mod_ssl not working unless mod_md is included.

[Steffen]

Fix available https://www.apachelounge.com/viewtopic.php?p=36635 :

mod_md: /.well-known/acme-challenge requests that cannot be answered for hostnames
outside the configured MDs are free to be answered by other handlers. This allows
co-existance between mod_md and other ACME clients on the same server (implements PR62189).
[Stefan Eissing, Arkadiusz Miskiewicz <arekm@maven.pl>]


http://svn.apache.org/viewvc?view=revision&sortby=date&revision=1827175

Again thanks for reporting !

[pbhq]