2

I have an Ubuntu server on Digital Ocean from which I'm running mainly a single domain, with multiple subdomains: domain.com, sub1.domain.com, sub2.domain.com, etc. Each has it's own Virtual Host.

The Virtual Hosts are all configured via their own config files in /etc/apache2/sites-available:

domain.conf // port 80
domain-le-ssl.conf // port 443
sub1.domain.conf
sub1.domain-le-ssl.conf
etc...

I have an SSL certificate setup for all of them via Let'sEncrypt / Certbot, forcing a redirect to HTTPS on all of them. Until now this has been working just fine. However, I now want to add another subdomain, sub3.domain.com.

I copied the conf files for sub2.domain.com and changed the relevant paths, servername, etc.:

sub3.domain.conf:

    <VirtualHost *:80>
    ServerName sub3.domain.com
    DocumentRoot /var/www/sub3_domain/html
    <Directory "/var/www/sub3_domain/html">
        # use mod_rewrite for pretty URL support
        RewriteEngine on
        # If a directory or a file exists, use the request directly
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        # Otherwise forward the request to index.html
        RewriteRule . index.html
    </Directory>
RewriteCond %{SERVER_NAME} =sub3.domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

sub3.domain-le-ssl.conf:

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName sub3.domain.com
    DocumentRoot /var/www/sub3_domain/html
    <Directory "/var/www/sub3_domain/html">
        # use mod_rewrite for pretty URL support
        RewriteEngine on
        # If a directory or a file exists, use the request directly
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        # Otherwise forward the request to index.html
        RewriteRule . index.html
    </Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/domain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateChainFile /etc/letsencrypt/live/domain.com/chain.pem
</VirtualHost>
</IfModule>

With all this setup, I then ran certbot-auto to renew my certificate and add the new subdomain to the certificate. When prompted for which sites I wanted to add, I left it blank and pressed enter for 'all' (sub3.domain was included in that list). It then correctly picked up that I had added a new subdomain and asked if I wanted to expand the license to cover the new domain. Hit 'e' for expand, and off it went, performing challenges.

Right away, things seemed a little off, since for all my existing domains, it performed tls-sni-01 challenges, but for my new one, it performed a http-01 challenge:

tls-sni-01 for domain.com
tls-sni-01 for sub1.domain.com
tls-sni-01 for sub2.domain.com
http-01 for sub3.domain.com

Sure enough, within a few seconds, I had the following output:

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: sub3.domain.com
   Type:   unauthorized
   Detail: Invalid response from
   http://sub3.domain.com/.well-known/acme-challenge/lKPYKHvStBag4YFzmfRbO7UpEINC4SYjEPMj-R_J-BY:
   "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   <html><head>
   <title>403 Forbidden</title>
   </head><body>
   <h1>Forbidden</h1>
   <p"

To my knowledge, I don't have any particular or specific .htaccess or other such rules that would result in any subdirectory being forbidden - and in any case, why a different test for that one server?

I also tried this without copying the sub3.domain-le-ssl.conf file, since I do believe that's actually generated by certbot-auto. The process and outcome was identical.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.