Note: To use the webroot plugin, your server must be configured to serve files from hidden directories. If /.well-known is treated specially by your webserver configuration, you might need to modify the configuration to ensure that files inside /.well-known/acme-challenge are served by the webserver.
root@ownCloud:/usr/local/www # ll total 29 drwxr-xr-x 3 root wheel 3 May 10 2016 .well-known/ lrwxr-xr-x 1 www www 25 May 10 2016 nginx@ -> /usr/local/www/nginx-dist dr-xr-xr-x 3 www www 6 Jan 6 19:30 nginx-dist/ drwxr-xr-x 16 www www 31 Jan 6 17:08 owncloud/ lrwxr-xr-x 1 root wheel 34 May 10 2016 robots.txt@ -> /usr/local/www/owncloud/robots.txt root@ownCloud:/usr/local/www #
root@ownCloud:/usr/local/etc/nginx # ll total 99 drwxr-xr-x 2 root wheel 2 Jan 7 12:23 .well-known/ -rw-r--r-- 1 root wheel 1007 May 10 2016 fastcgi_params -rw-r--r-- 1 root wheel 1007 May 10 2016 fastcgi_params-dist -rw-r--r-- 1 root wheel 2837 May 10 2016 koi-utf -rw-r--r-- 1 root wheel 2223 May 10 2016 koi-win -rw-r--r-- 1 root wheel 3957 May 10 2016 mime.types -rw-r--r-- 1 root wheel 3957 May 10 2016 mime.types-dist -rw-r--r-- 1 root wheel 2190 Jan 7 12:22 nginx.conf -rw-r--r-- 1 root wheel 2871 May 10 2016 nginx.conf-dist -rw-r--r-- 1 root wheel 1867 May 10 2016 nginx.conf.save -rw-r--r-- 1 root wheel 636 May 10 2016 scgi_params -rw-r--r-- 1 root wheel 636 May 10 2016 scgi_params-dist -rw-r--r-- 1 root wheel 664 May 10 2016 uwsgi_params -rw-r--r-- 1 root wheel 664 May 10 2016 uwsgi_params-dist -rw-r--r-- 1 root wheel 3610 May 10 2016 win-utf root@ownCloud:/usr/local/etc/nginx #
server {
listen 443 ssl;
root /usr/local/www;
location = /robots.txt { allow all; access_log off; log_not_found off; }
location = /favicon.ico { access_log off; log_not_found off; }
location /.well-known {
root /usr/local/www;
}
location ^~ /owncloud {
client_max_body_size 131072M;
error_page 403 /owncloud/core/templates/403.php;
error_page 404 /owncloud/core/templates/404.php;
location /owncloud {
rewrite ^ /owncloud/index.php$uri;
}
location ~ ^/owncloud/(?:build|tests|config|lib|3rdparty|templates|data)/ {
deny all;
}
location ~ ^/owncloud/(?:\.|autotest|occ|issue|indie|db_|console) {
deny all;
}
location ~ ^/owncloud/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|upda
include fastcgi_params;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/var/run/php-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param front_controller_active true;
certbot certonly
It gives me an error...
Failed authorization procedure. freenasowncloud.info (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://freenasowncloud.info/.well-known/acme-challenge/anoJwPjl9quUXNs7nBqa3oeq_sURaQ-dufqnhi17rlk: "<html> <head><title>400 The plain HTTP request was sent to HTTPS port</title></head> <body bgcolor="white"> <center><h1>400 B" IMPORTANT NOTES: - The following errors were reported by the server: Domain: freenasowncloud.info Type: unauthorized Detail: Invalid response from http://freenasowncloud.info/.well-known/acme-challenge/anoJwPjl9quUXNs7nBqa3oeq_sURaQ-dufqnhi17rlk: "<html> <head><title>400 The plain HTTP request was sent to HTTPS port</title></head> <body bgcolor="white"> <center><h1>400 B" To fix these errors, please make sure that your domain name was entered correctly and the DNS A record(s) for that domain contain(s) the right IP address. root@ownCloud:/usr/local/etc/nginx #
400 Bad Request The plain HTTP request was sent to HTTPS portnginx/1.10.0
This is correct. You have to be listening and responding on port 80 for the renewal process to work. Did you not test the renewal process when you set everything up?
certbot renew --dry-runI'm betting that it's a browser cache issue on this one. If you don't clear your browser cache after making a change you're going to still be connecting via https.
server {
listen 80;
server_name boredguy.chickenkiller.com www.boredguy.chickenkiller.com boredguy.showersnet.com www.boredguy.showersnet.com;
location /.well-known {
root /usr/local/www/nginx;
}
location / {
return 301 https://boredguy.showersnet.com$request_uri;
}
Set up a cron task to run when you see fit. Certbot recommends twice a day so that's how I set mine up. You set it up in the FreeNAS gui under "tasks". On the command line enter the following with your jail name listed and it will run automatically.
jexec yourjailnamewithnospaces csh certbot renew --quiet
