NGINX Reverse proxy acme-challenge http to 404

Question

First sorry for my poor english^^

I tried to set up a reverse proxy, and it work fine. Now i want to obtain a ssl certificate with letsencrypt and i failed^^

On the reverse proxy i creat a file 1234.txt to try connect to it.

I can connect to https://mysite/.well-known/acme-challenge/1234.txt, but i cannot on http://mysite/.well-known/acme-challenge/1234.txt i obtain an error 404.

Where i make a mistake on my nginx conf?

    upstream [MySite].com {
    server "[MySite].com";
}
server {
    listen 80;
    root /var/www/html/[MySite].com;
    
    rewrite ^(.*) https://$host$1 permanent;
    
    location ~/.well-known/ {
        allow all;
    }
}
server {
    listen 443 ssl;
    server_name [MySite].com;
    ssl_certificate /etc/nginx/ssl/mysite.crt;
    ssl_certificate_key /etc/nginx/ssl/mysite.depro.key;
    proxy_redirect off;
    
    location / {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass https://X.X.X.X:8006;
        proxy_buffering off;
        client_max_body_size 0;
        proxy_connect_timeout 3600s;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        send_timeout 3600s;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    
    location ~/.well-known/ {
        allow all;
    }
}

Thanks a lot for reply,

Regards,

You need to wrap the `rewrite ^(.*) https://$host$1 permanent;` statement within a `location / { ... }` block, otherwise the `location ~/.well-known/` block is never seen. — Richard Smith, Sep 13 '22 at 08:13
Also, you are missing a `root` statement in the second `server` block. Was that just an error in your question? — Richard Smith, Sep 13 '22 at 08:14
Hi Richard Smith, thanks for reply. Would you mind to explain me the "You need to wrap the rewrite ^(.*) https://$host$1 permanent; statement within a location / { ... } block," in my conf what i have to modify? — ArnOCP, Sep 13 '22 at 09:03
Replace the `rewrite` statement with: `location / { rewrite ^(.*) https://$host$1 permanent; }` or more simply `location / { return 301 https://$host$request_uri; }` — Richard Smith, Sep 13 '22 at 09:13
Thanks Richard, but i still have the same problem: https is ok, http is KO???? — ArnOCP, Sep 13 '22 at 09:29
What about the `root`? You have no `root` definition on your `https` site, so it is using Nginx's default root. Where is the `acme-challenge/1234.txt` file located. Is it `/var/www/html/[MySite].com/.well-known/acme-challenge/1234.txt` or somewhere else like `/var/www/html/.well-known/acme-challenge/1234.txt`? — Richard Smith, Sep 13 '22 at 12:47
Richard, i modify the conf like this: *'location / { return 301 https://$host$request_uri; } location ~/.well-known/ { allow all; root /var/www/html/[MySite].com/.well-known; } } listen 443 ssl; ... root /var/www/html/[MySite].com;*' The acme-challenge is in the reverse proxy on /var/www/html/[MySite].com/.well-known/acme-challenge/1234.txt Regards – — ArnOCP, Sep 13 '22 at 13:55

score 0 · Accepted Answer · answered Sep 14 '22 at 06:45

Good morning, After a lot of trying i manage to access to http. Yes! Thanks Richard, Here is the correct conf file:

upstream [MySite].com {
        server "[MySite].com";
}
server {
        listen 80;
        server_name [MySite].com;
        root /var/www/html/[MySite].com;
        location / {
                return 301 https://$host$request_uri;
        }

        location ~/.well-known {
                allow all;
                }
}
server {
        listen 443 ssl;
        server_name [MySite].com;
        ssl_certificate /etc/nginx/ssl/CERT.crt;
        ssl_certificate_key /etc/nginx/ssl/CERT.depro.key;
        proxy_redirect off;
        root /var/www/html/[MySite].com;
        location / {
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_pass https://IP_DISTANTE:8006;
                proxy_buffering off;
                client_max_body_size 0;
                proxy_connect_timeout 3600s;
                proxy_read_timeout 3600s;
                proxy_send_timeout 3600s;
                send_timeout 3600s;
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
        }

        location ~/.well-known {
                allow all;
            }
}

Regards,

NGINX Reverse proxy acme-challenge http to 404

1 Answers1