Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

AutoSSL unable to renew

Discussion in 'Security' started by mreidgs, Dec 12, 2017.

Tags:
  1. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    1:55:40 PM WARN The domain “example.com” failed domain control validation: The system queried for a temporary file at “http://example.com/.well-known/pki-validation/C0658CFEA061A9D926F37CFD09D62DF5.txt”, but the web server responded with the following error: 403 (Forbidden). A DNS (Domain Name System) or web server misconfiguration may exist.

    I log into the server via SSH and go look in that directory and there are no .txt files there.

    I have 3 different cPanel servers and all the domains I try to renew on these servers are having this same issue.

    CentOS 6.9, WHM v68.0.19
     
    #1 mreidgs, Dec 12, 2017
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    It looks like access to the DCV file was blocked. Could you let us know the contents of the .htaccess file in one of the affected account's public_html directory? Ensure to replace any real domain names or IP addresses with examples.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelMichael, Dec 12, 2017
  3. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    Code:
    # BEGIN iThemes Security - Do not modify or remove this line
# iThemes Security Config Details: 2
   # Ban Hosts - Security > Settings > Banned Users
   SetEnvIF REMOTE_ADDR "^x\.x\.x\.x$" DenyAccess
   SetEnvIF X-FORWARDED-FOR "^x\.x\.x\.x$" DenyAccess
   SetEnvIF X-CLUSTER-CLIENT-IP "^x\.2x\.x\.x$" DenyAccess
**bunch of these repeated**

     <IfModule mod_authz_core.c>
       <RequireAll>
           Require all granted
           Require not env DenyAccess
           Require not ip x.x.x.x
**bunch of these repeated**
       </RequireAll>
   </IfModule>
 
<IfModule !mod_authz_core.c>
       Order allow,deny
       Allow from all
       Deny from env=DenyAccess
       Deny from x.x.x.x
**bunch of these repeated**
   </IfModule>
# END iThemes Security - Do not modify or remove this line

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/[0-9]+\..+\.cpaneldcv$
RewriteCond %{REQUEST_URI} !^/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule . /index.php
</IfModule>

# END WordPress
     
    #3 mreidgs, Dec 13, 2017
    Last edited by a moderator: Dec 19, 2017
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Does this system use EasyApache 4? If so, check to verify "Use a Global DCV Passthrough instead of .htaccess modification (requires EA4)" is enabled under the "Domains" tab in "WHM >> Tweak Settings". Otherwise, if you are using EasyApache 3, you will need to modify your .htaccess rules to ensure access attempts from Comodo to the ".well-known" directory are not blocked or restricted.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelMichael, Dec 13, 2017
  5. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    I'm looking at a server using EA4 and I do not see that setting in Tweak settings.
     
    #5 mreidgs, Dec 14, 2017
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    What version of cPanel is installed on this server? Are you logged in via WHM as root?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 cPanelMichael, Dec 15, 2017
  7. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    v68.0.20 and logged in as root.
     
    #7 mreidgs, Dec 19, 2017
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you scroll down to the last options listed under the "Domains" tab in "WHM >> Tweak Settings" and upload a screenshot of what you see?

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #8 cPanelMichael, Dec 19, 2017
  9. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    Here is a screenshot.

    What specifically would I add to .htaccess so that access to ".well-known" directory is not blocked?
     

    Attached Files:

    #9 mreidgs, Dec 19, 2017
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    44,367
    Likes Received:
    1,857
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    It looks like it's your "Deny" rules as opposed to your Mod_Rewrite rules that are preventing AutoSSL from completing the domain validation process. The rules look similar to what's referenced by another user on the following thread:

    AutoSSL: The certificate is not available. (processing)

    A workaround is suggested on the above post, so you may want to see if that helps.

    As far as the "Use a Global DCV Passthrough instead of .htaccess modification (requires EA4)" option, that won't solve this particular issue, however you should still see the option if you are using cPanel version 68 and EasyApache 4. The fact that it's missing suggests you might be using an older version of cPanel. You can verify the version of cPanel installed with the following command:

    Code:
    cat /usr/local/cpanel/version
    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #10 cPanelMichael, Dec 19, 2017
  11. mreidgs

    mreidgs Member

    Joined:
    Nov 7, 2017
    Messages:
    12
    Likes Received:
    2
    Trophy Points:
    3
    Location:
    Calgary
    cPanel Access Level:
    Root Administrator
    Looking into this solution.

    Thanks.
     
    #11 mreidgs, Dec 20, 2017
(You must log in or sign up to post here.)
Loading...
Similar Threads - AutoSSL unable renew
  1. user1234_am

    AutoSSL certificate is unable to be renewed without reduction in coverage

    user1234_am, Feb 24, 2018, in forum: Security
    Replies:
    2
    Views:
    467
    cPanelNick
    Feb 24, 2018
  2. nivekau

    AutoSSL unable to replace certificate - failed domain control validation

    nivekau, May 6, 2018, in forum: Security
    Replies:
    7
    Views:
    432
    cPanelLauren
    May 9, 2018
  3. rangka_kacang

    unable to delete nobody hostname autossl

    rangka_kacang, Jan 31, 2018, in forum: General Discussion
    Replies:
    2
    Views:
    236
    rangka_kacang
    Jan 31, 2018
  4. gullableJoe

    SOLVED Unable to generate AutoSSL for accounts

    gullableJoe, Aug 17, 2017, in forum: Security
    Replies:
    2
    Views:
    733
    gullableJoe
    Aug 27, 2017
  5. joako

    New Thread Create AutoSSL for "Parked Domain"

    joako, Aug 17, 2018 at 8:37 PM, in forum: Security
    Replies:
    0
    Views:
    24
    joako
    Aug 17, 2018 at 8:37 PM

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice