29

Should I leave the /.well-known/acme-challenge always exposed on the server? Here is my config for the HTTP: 

server {
 listen 80;

 location '/.well-known/acme-challenge' {
    root        /var/www/demo;
  }

 location / {
          if ($scheme = http) {
            return 301 https://$server_name$request_uri;
          }
 }

Which basically redirects all the requests to https, except for the acme-challenge (for auto renewal). My question: Is it alright to keep location '/.well-known/acme-challenge' always exposed on port 80? Or better to comment/uncomment it manually, when need to reissue the certificate? Are there any security issues with that?

Any advise or links to read for about the this location appreciated. Thanks!

Ilya
  • 1,120
  • 1
  • 12
  • 33

4 Answers4

14

Acme challenge link only needed for verifying domain to this ip address

Renjith Thankachan
  • 4,178
  • 1
  • 30
  • 47
  • 1
    I've also read that its used for temp files during verification and then deletes them. So I guess its the right answer. Thanks! – Ilya Jan 23 '17 at 12:00
  • 1
    Verifying when? Only once to get the certificate? Or is it needed again? If it's only needed to obtain the certificate, then I assume you can safely delete the .well-known directory...? – PJ Brunet Jul 15 '19 at 03:39
  • 2
    Yes, you can delete it after getting certificate but you need that folder at renewal time! – Renjith Thankachan Jul 15 '19 at 03:44
  • 1
    this answer should be expanded. It is barely a complete sentence, and provides no context, explanation, or links to documentation. – Felipe Feb 21 '23 at 00:55
9

You do not need to keep the token available once your certificate has been signed. However, there is not much harm in leaving it available either, as explained by a Certbot engineer:

The token is part of a particular challenge which is no longer active, from the ACME server's point of view, after the server has tried to validate it. It would reveal a little bit of information about how you get certificates, but should not allow someone else to issue certificates for your site or impersonate you.

natevw
  • 16,807
  • 8
  • 66
  • 90
0

In case someone finds this helpful, I just asked my hosting customer support and they explained it as per following...

Yes, “well-known” folder is automatically created by cPanel in order to validate your domain for AutoSSL purposes. AutoSSL is an added feature of cPanel/WHM which offer you free SSL certificate for your domains, its also known as self-signed SSL certificate. The folder .well-known created while the time of the domain validation process as a part of AutoSSL installation

And it is not the file that needs to be removed, It does not cause any issue.

Oliver M Grech
  • 3,071
  • 1
  • 21
  • 36
-10

The period before the file name (.well-known) means it is a hidden directory. If your server gets hacked the information is available to the hacker.

Unheilig
  • 16,196
  • 193
  • 68
  • 98
xtreme deals
  • 1