I have a Tomcat server running behind Apache using mod_jk (the AJP connector in Tomcat). I just tried adding SSL to this setup with LetsEncrypt, but certbot was unable to verify that I own the domain since it could not access the challenge files, as Apache was proxying all requests to Tomcat. How can I get a LetsEncrypt certificate for my server with my current setup?
Add a comment
|
1 Answer
You can use the JkUnMount directive to prevent a directory from being handled by Tomcat. You can let the acme challenge directory be handled by Apache.
The configuration for that might look like:
JkUnMount /.well-known/acme-challenge/* *
The final * should unmount it from all configured workers. If you want to exclude that directory for just one of several workers, you can use the worker name instead.
I prefer to use reverse proxy over mod_jk with Tomcat, mostly because I find it easier to debug. Excluding directories is similar with reverse proxy. The configuration is:
ProxyPass /.well-known/acme-challenge/ !
answered Feb 22, 2018 at 21:22
-
It's been a while since I set this up, where is the config file I need to put this in located? Commented Feb 22, 2018 at 21:24
-
You should already have an Apache configuration file with a
JkMountin it, it should go in that same file. Where that file is will depend on your OS distribution and whether or not you are using virtual hosts. On my Ubuntu Linux system it would be under/etc/apache2/sites-available/example.com.conffor my example.com website. Commented Feb 22, 2018 at 21:26 -
1Your solution almost worked, I had to change
JkUnMount /.well-known/acme-challenge/ *toJkUnMount /.well-known/acme-challenge/* *. Basically, it was routing only that specific page to Apache, not the entire directory. I have edited the answer to reflect it, and will accept it when that change is made. Commented Feb 23, 2018 at 1:28 -
I edited that in for you. Thank you for coming back with corrections. Commented Feb 23, 2018 at 1:31