{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/221","repository_url":"https://api.github.com/repos/letsencrypt/acme-spec","labels_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/221/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/221/comments","events_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/221/events","html_url":"https://github.com/letsencrypt/acme-spec/issues/221","id":103880349,"number":221,"title":".well-known ACME challenge files blocked 403 Forbidden in some Nginx configurations","user":{"login":"centminmod","id":5899584,"avatar_url":"https://avatars.githubusercontent.com/u/5899584?v=3","gravatar_id":"","url":"https://api.github.com/users/centminmod","html_url":"https://github.com/centminmod","followers_url":"https://api.github.com/users/centminmod/followers","following_url":"https://api.github.com/users/centminmod/following{/other_user}","gists_url":"https://api.github.com/users/centminmod/gists{/gist_id}","starred_url":"https://api.github.com/users/centminmod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/centminmod/subscriptions","organizations_url":"https://api.github.com/users/centminmod/orgs","repos_url":"https://api.github.com/users/centminmod/repos","events_url":"https://api.github.com/users/centminmod/events{/privacy}","received_events_url":"https://api.github.com/users/centminmod/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-29T20:38:23Z","updated_at":"2016-03-06T23:47:16Z","closed_at":null,"body":"Hi this is related to Letsencrypt manual authenticator mode with the ACME challenge file having a dot prefix https://github.com/letsencrypt/letsencrypt/issues/730. This can be blocked with 403 Forbidden access by some Nginx configurations which block dot prefix files/folders from web access by default.\r\n\r\ni.e.\r\n\r\n    location ~ /\\.          { access_log off; log_not_found off; deny all; }\r\n\r\nFor a workaround for me, I had to add this to my Nginx vhost\r\n\r\n    location ~ /.well-known {\r\n          location ~ /.well-known/acme-challenge/(.*) {\r\n                  more_set_headers    \"Content-Type: application/jose+json\";\r\n          }\r\n    }   \r\n\r\nProbably need to document this for folks as to requirements needed for Nginx to allow dot prefix file for `.well-known` requests\r\n\r\nnot sure if you just add a curl check of the ACME challenge file for the status code so if it's anything other than 200 status, you can show a more detailed explanation ? i.e. if it's 403 status for the curl header check, say\r\n\r\n    ensure nginx vhost allows dot prefix directory access to /.well-known\r\n"},"comment":{"url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/comments/193017709","html_url":"https://github.com/letsencrypt/acme-spec/issues/221#issuecomment-193017709","issue_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/221","id":193017709,"user":{"login":"mnpenner","id":1112998,"avatar_url":"https://avatars.githubusercontent.com/u/1112998?v=3","gravatar_id":"","url":"https://api.github.com/users/mnpenner","html_url":"https://github.com/mnpenner","followers_url":"https://api.github.com/users/mnpenner/followers","following_url":"https://api.github.com/users/mnpenner/following{/other_user}","gists_url":"https://api.github.com/users/mnpenner/gists{/gist_id}","starred_url":"https://api.github.com/users/mnpenner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnpenner/subscriptions","organizations_url":"https://api.github.com/users/mnpenner/orgs","repos_url":"https://api.github.com/users/mnpenner/repos","events_url":"https://api.github.com/users/mnpenner/events{/privacy}","received_events_url":"https://api.github.com/users/mnpenner/received_events","type":"User","site_admin":false},"created_at":"2016-03-06T23:47:16Z","updated_at":"2016-03-06T23:47:16Z","body":"Thank you @riobard. I was trying with\r\n\r\n    location '/.well-known/acme-challenge' {\r\n        default_type \"text/plain\";\r\n        root        /tmp/letsencrypt-auto;\r\n    }\r\n\r\nBut that didn't do it... I guess nginx keeps processing the other restrictions. Yours seems to do the trick though."}}