Let's Encrypt when using Reverse Proxy

Support
1

Hi all,

Problem Description

I am trying to configure a domain with Sympl/Apache and then reverse proxy it to a backend service. In this case, Ghost which listens on localhost:2368
I have tried to correctly set up the domain to exclude Proxying the ./well-known folder by including the following line.

 #Add line to NOT proxy ./well-known so Let's Encrypt can validate the domain directy with Apache.
  ProxyPass /.well-known/$ !

Further down I then have:

# Disable indexes by default on the top-level.
  <LocationMatch "^/+$">
    Options -Indexes
  </LocationMatch>

  # Disable any restrictions or rewrites to /.well-known/acme-challenge
  #   This ensures Let's Encrypt can validate domain ownership.
  <Directory /srv/*/public/htdocs/.well-known/acme-challenge/ >
    Require all granted
    <IfModule rewrite_module>
      RewriteEngine off
    </IfModule>
  </Directory>

  <IfModule rewrite_module>
    # Block access to files and directories starting with '.', other than ./well-known/
    RewriteEngine on
    RewriteCond %{REQUEST_URI} .*/\..*
    RewriteCond %{REQUEST_URI} !/\.well\-known/.*
    RewriteRule ^(.*)$ - [R=403]
  </IfModule>

  #Added to forward to the GHOST install - proxy
  ProxyPreserveHost On
  #Servers to proxy the connection, or
  #List the application servers Usage
  ProxyPass / http://localhost:2368/
  ProxyPassReverse / http://localhost:2368/

Unfortunately it doesn’t seem to be paying any attention to this and I’m struggling to get Sympl to get a certificate and thus enable an SSL/TLS config.

I have tried with a suggestion to try adding a file within ./well-known and have added test.txt. I can’t browse to www.domain.uk/.well-known/test.txt - I get a file not found.

This site is served on an IPV6 only server so I also have the added issue of getting the DNS and IPv4 proxy working through Mythic-Beasts. I think this is working correctly as I have also set up www.domain.com but without any apache reverse proxying (just normal vhost) and I can access a simliarly placed www.domain.com/.well-known/test.txt. Domain.com has also managed to be configured with a certificate too.

So I’m fairly convinced it’s my own config causing the problem or I’m not getting Apache to actually serve the ./well-known folder locally.
I’d appreciate any suggestions on what I’m not doing right here, thanks

Cheers
Martin

Environment

  • Sympl Version: 13.20250828.0
  • Sympl Testing Version:
  • Debian Version: 6.12.101+deb13-cloud-amd64
  • Hardware Type: Virtual Server
  • Hosted With: Mythic-Beasts
2

I never managed to do this. Instead I wrote a bash script to remove the reverse proxy, reload apache, renew the certificate, put the proxy back, reload apache.
Only takes a very short time, so its a suitable workaround, but if there was a way to sidestep the .wellknown proxy, I would.

3

Hi,

Thanks for the reply. Yeah that sounds like a reasonable work around, at least someone else has experienced a similar problem and I’m not completely bashing my head against the wall. Everything I’d searched for so far indicated not reverse proxying a folder “should” have worked.

Cheers