AutoSSL Validation Text File
Am I correct in saying the temporary file created by AutoSSL is now suffixed with .cpaneldcv instead of .tmp? Is that a change as a result of this issue?
Also, I am not sure if this was the case for the people above, but I am also having to allow for text files at the route of my domain to allow AutoSSL verification to succeed (for apparently random file names such as DBX5F9D00C98A8EACAD30E2CE75A1F4A.txt).
-
Hello @IanD, I've moved this post to it's own thread. New Am I correct in saying the temporary file created by AutoSSL is now suffixed with .cpaneldcv instead of .tmp? Is that a change as a result of this issue?
Yes, however the TXT files will exist as well to allow for validation. The following case was included with cPanel version 60: Fixed case CPANEL-6147: Exclude SSL DCV checks from .htaccess RewriteRule. The GET request to validate the certificate was updated to this format:localIPAddress.here - [02/Nov/2016:16:08:44 -0400] "GET /32143.BIN_AUTOSSL_CHECK_PL__.OzcZVbb1.cpaneldcv HTTP/1.1" 200 64 "-" "Cpanel-HTTP-Client/1.0"
Additionally, the following rules are now automatically added before each RewriteRule in the .htaccess file to exclude the GET request used in cPanel 60. These create exceptions (note the preceding !) so that matching REQUEST_URIs do not get rewritten:RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}.txt(?:\ Comodo\ DCV)?$ RewriteCond %{REQUEST_URI} !^[0-9]+\..+\.cpaneldcv$
This should address most instances where domain validation failed due to existing rewrite rules.Also, I am not sure if this was the case for the people above, but I am also having to allow for text files at the route of my domain to allow AutoSSL verification to succeed (for apparently random file names such as DBX5F9D00C98A8EACAD30E2CE75A1F4A.txt).
Could you let us know the specific rules in the .htaccess that prevents validation? I can check if an existing case or workaround exists to address the specific rules. Thank you.0 -
Thanks Michael. Sure, I followed some docs somewhere and created a new .conf file in /usr/local/apache/conf/userdata/std, which I believe is built into httpd.conf (non SSL). It's just a blanket rewrite rule: RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L,QSA]
Would be useful if the implementation you outline above could be extended to include this case usage? Ian0 -
Would be useful if the implementation you outline above could be extended to include this case usage?
Could you let us know if domain validation still fails in cPanel version 60 when removing that custom entry? The new rewrite rules automatically populated in the .htaccess files in cPanel version 60 might already address the issue. If not, could you let us know the contents within the account's .htaccess file that's blocking TXT files? Thank you.0 -
Sorry, I am confused as to what you are asking? It is the rule that I am including that forces the domain validation to fail. I am happily working around it with the RewriteConds (enhanced with your code sample - thanks). I think because I am not including in a .htaccess file, instead going direct into the virtual host ( 0 -
Hello, For instance, if you were to remove all custom changes made when domain validation failed for your domain names in cPanel version 58, does validation still fail in cPanel version 60? Thank you. 0 -
Hi This was only a change I've added since I upgraded to cPanel 60 so I can't answer that I'm afraid. As I say my workaround is working fine. But if I can help you more please let me know. I'll be upgrading to EasyApache 4 soon which I don't believe (at least on first glance) supports the .conf include system I've used which is available in 3. Hopefully I'll not be back soon! 0 -
I believe the workaround you are using is no longer required as of cPanel version 60, but feel free to let us know if you encounter any additional issues if you choose to disable those workaround rules. Regarding custom EA4 Apache configuration changes, this document provides a list of supported methods: Advanced Apache Configuration - EasyApache 4 - cPanel Documentation Thanks! 0 -
I have fixed this issue deactivating the OWASP from Security -> Security Providers: OWASP ModSecurity Core Rule Set OWASP ModSecurity Core Rule Set V3.0 Then, reactivate AutoSSL for all users, wait some time in order to leave ther system to install certificates for every domain name and go back to OWASP to activate again the security. 0
Please sign in to leave a comment.
Comments
8 comments