Letsencrypt with webroot on Apache

letsencrypt-webroot-apache.md

Config Apache with /etc/apache2/conf-available/le.conf:

Alias /.well-known/acme-challenge/ "/var/www/html/.well-known/acme-challenge/"
<Directory "/var/www/html/">
    AllowOverride None
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    Require method GET POST OPTIONS
</Directory>

Enable config:

sudo a2enconf le

Install cert / renew cert:

certbot-auto certonly --non-interactive --register-unsafely-without-email --agree-tos --expand --webroot --webroot-path /var/www/html --domain my-domain.org
certbot-auto renew --webroot --webroot-path /var/www/html --no-self-upgrade

This works well even with virtual hosts and their mapping via ServerName.

Thanks, that help me!

Thanks, I had to set an additional proxy condition to ensure mod_proxy wouldn't interfere.
ProxyPass /.well-known !
ProxyPass / http://127.0.0.1:9999/

Thank you @slat, this works great!

This was my answer after an afternoon of work. Cheers.

Just a note - if will not work if somewhere in other Apache sites you have Location / block - it will override this configuration. I solved it by removing Location block at all

Thanks so much for sharing this!

Thanks, I had to set an additional proxy condition to ensure mod_proxy wouldn't interfere.
ProxyPass /.well-known !
ProxyPass / http://127.0.0.1:9999/

thank you @slat, that was very helpful for my mastodon instance. (:

Helped us a lot, thanks!

If you have changed the port of apache2, you need to change back to 80 port or certbot can't pass ACME verification.

   # 1. edit ports.conf 
   vim /etc/apache2/ports.conf 
   # 2. edit Listen 8888(or the number you had set) -> Listen 80 and save it
   # 3. edit sites-enable file
   vim /etc/apache2/sites-enabled/000-default.conf # or you write your config in another .conf file
   # 4. replace all <VirtualHost *:80> to <VirtualHost *:8888>
   # 5. restart apache2
   systemctl restart apache2
   # 6. look up if port has been applied.
   netstat -tlpn| grep apache
   ss -tlpn| grep apache

Thanks, I had to set an additional proxy condition to ensure mod_proxy wouldn't interfere.
ProxyPass /.well-known !
ProxyPass / http://127.0.0.1:9999/

Thank you @slat, I've been trying to solve the issue for about 3-4 hours, and your solution works perfectly :)

Indexes should not be enabled in the challenges directory...

I know this is old but someone pointed me here when i was having issues setting up LE and i wanted to ask where to i put that porxy info that was commented about?

@fizdog it usually goes into your site conf. Best thing to do is finding documentation or a tutorial about mod_proxy how to install (it requires prerequisites) and how to use.

@fizdog it usually goes into your site conf. Best thing to do is finding documentation or a tutorial about mod_proxy how to install (it requires prerequisites) and how to use.

Ok will do. Thanks for the info.