Install LetsEncrypt On Subdomain With Phoenix / Apache2

The error is because you are forwarding everything to phoenix, including the cerbot’s challenge, which is a static file generated on the fly by certbot. The easiest thing to do is to get the certbot working before setting up any reverse proxy. You do not nee the challenge response to renew the cert, only for the initial setup.

Thanks a lot, I greatly appreciate it. This did the trick.

Since it’s almost 90 days, LetsEncrypt is giving me errors that the auto renew is not working. I need some help getting LetsEncrypt installed correctly. As I’ve learned more about Phoenix, there have been some changes and I can’t remember how I got LetsEncrypt installed the first time.

Here is my setup for Apache:

<VirtualHost *:443>
    ServerName ex.mysite.com
    DocumentRoot /home/username/mysite.com
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    <Location /*>  # is /* path correct for my proxy pass setup?
      Require ip 127.0.0.1 ***.***.***.***
    </Location>
    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^/?(.*) "ws://127.0.0.1:4000/$1" [P,L]

    ProxyRequests Off
    ProxyPass        / http://127.0.0.1:4000/
    ProxyPassReverse / http://127.0.0.1:4000/

    ProxyPass        /socket/ ws://127.0.0.1:4000/socket/
    ProxyPassReverse /socket/ ws://127.0.0.1:4000/socket/
</VirtualHost>

Here is the LetsEncrypt certbot command I’m trying to use:

 sudo certbot --authenticator webroot --webroot-path / --installer apache -n -d ex.mysite.com

To begin with, I’m not sure if I’m using the <Location /*> correctly in Apache and how that translates to the certbot command for installing a certificate. The phoenix project works this way, but I’m not sure if it’s the proper way or not. On regular non-phoenix websites, I use a standard path like “/home/username/mysite.com”, so I’m not sure how this gets setup for the socket and proxy pass. I tried commenting out the proxy pass / socket stuff as well, but letsencrypt still fails.

Lastly, this is the error that comes up in the Phoenix logs:

[info] GET /.well-known/acme-challenge/_JUybFBVPXS5vJVzhokjsigd21GeR1V85JigusrWERQ
[debug] ** (Phoenix.Router.NoRouteError) no route found for GET /.well-known/acme-challenge/_JUybFBVPXS5vJVzhokjsigd21GeR1V85JigusrWERQ (ExchatWeb.Router)
    (exchat 0.1.0) lib/phoenix/router.ex:402: ExchatWeb.Router.call/2
    (exchat 0.1.0) lib/exchat_web/endpoint.ex:1: ExchatWeb.Endpoint.plug_builder_call/2
    (exchat 0.1.0) lib/plug/debugger.ex:136: ExchatWeb.Endpoint."call (overridable 3)"/2
    (exchat 0.1.0) lib/exchat_web/endpoint.ex:1: ExchatWeb.Endpoint.call/2
    (phoenix 1.5.12) lib/phoenix/endpoint/cowboy2_handler.ex:65: Phoenix.Endpoint.Cowboy2Handler.init/4
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_handler.erl:37: :cowboy_handler.execute/2
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_stream_h.erl:306: :cowboy_stream_h.execute/3
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_stream_h.erl:295: :cowboy_stream_h.request_process/3
    (stdlib 3.15.2) proc_lib.erl:226: :proc_lib.init_p_do_apply/3

How would you get this setup to work?

Thanks

Just a stab in the dark here. Do you have .well-known as a static dir in endpoint.ex?

I do not. I’m not exactly sure what I’m supposed to do for this LetsEncrypt thing. Here is what I have:

/lib/exchat_web/endpoint.ex

defmodule ExchatWeb.Endpoint do
  use Phoenix.Endpoint, otp_app: :exchat

@session_options [
    store: :cookie,
    key: "_exchat_key",
    signing_salt: "0MwdBngh"
  ]

  socket "/socket", ExchatWeb.UserSocket,
    websocket: true,
    longpoll: false

  socket "/live", Phoenix.LiveView.Socket, websocket: [connect_info: [session: @session_options]]

  # Serve at "/" the static files from "priv/static" directory.
  #
  # You should set gzip to true if you are running phx.digest
  # when deploying your static files in production.
  plug Plug.Static,
    at: "/",
    from: :exchat,
    gzip: false,
    only: ~w(css fonts images js favicon.ico robots.txt)

  # Code reloading can be explicitly enabled under the
  # :code_reloader configuration of your endpoint.
  if code_reloading? do
    socket "/phoenix/live_reload/socket", Phoenix.LiveReloader.Socket
    plug Phoenix.LiveReloader
    plug Phoenix.CodeReloader
    plug Phoenix.Ecto.CheckRepoStatus, otp_app: :exchat
  end

  plug Phoenix.LiveDashboard.RequestLogger,
    param_key: "request_logger",
    cookie_key: "request_logger"

  plug Plug.RequestId
  plug Plug.Telemetry, event_prefix: [:phoenix, :endpoint]

  plug Plug.Parsers,
    parsers: [:urlencoded, :multipart, :json],
    pass: ["*/*"],
    json_decoder: Phoenix.json_library()

  plug Plug.MethodOverride
  plug Plug.Head
  plug Plug.Session, @session_options

  plug ExchatWeb.Router
end

Also: /lib/exchat_web/router.ex

defmodule ExchatWeb.Router do
  use ExchatWeb, :router

  pipeline :browser do
    plug :accepts, ["html"]
    plug :fetch_session
    plug :fetch_flash
    plug :protect_from_forgery
    plug :put_secure_browser_headers
  end

  pipeline :api do
    plug :accepts, ["json"]
  end

  scope "/", ExchatWeb do
    pipe_through :browser

    get "/", PageController, :index
  end


  scope "/ex", ExchatWeb do
    pipe_through :api

    post "/users/login", UserController, :login
    post "/users/anon-login", UserController, :anon_login
  end


  # Enables LiveDashboard only for development
  #
  # If you want to use the LiveDashboard in production, you should put
  # it behind authentication and allow only admins to access it.
  # If your application does not have an admins-only section yet,
  # you can use Plug.BasicAuth to set up some basic authentication
  # as long as you are also using SSL (which you should anyway).
  if Mix.env() in [:dev, :test, :prod] do
    import Phoenix.LiveDashboard.Router

    scope "/" do
      pipe_through :browser
      live_dashboard "/dashboard", metrics: ExchatWeb.Telemetry
    end
  end
end

I’ll need to know what to put into these files, and then what the LetsEncrypt command should be for the webroot path variable. It is tricky because these paths in the Phoenix app aren’t like normal paths in the Ubuntu operating system, which is what I usually use for LetsEncrypt

sudo certbot --authenticator webroot --webroot-path [what path to put here?] --installer apache -n -d ex.mysite.com

In endpoint.ex, with respect to .well-known, I am using it to access apple-app-site-association file in there and this is how I successfully access it(note the “~w” line):

  # Serve at "/" the static files from "priv/static" directory.
  #
  # You should set gzip to true if you are running phx.digest
  # when deploying your static files in production.
  plug Plug.Static,
    at: "/",
    from: :faithful_word,
    gzip: false,
    only: ~w(css fonts images js favicon.ico robots.txt .well-known uploads)

Thanks for the hint. Are you using a sub-domain for your setup?

I added .well-known to the “~w” line and ran the LetsEncrypt call:

sudo certbot certonly --webroot --webroot-path / -n -d ex.mysite.com --deploy-hook "systemctl reload apache2" --dry-run

but it’s still not working. The LetsEncrypt error comes up as:

   Domain: ex.mysite.com
   Type:   unauthorized
   Detail: Invalid response from
   https://ex.mysite.com/.well-known/acme-challenge/AmMMHM5SRA-EBC9u7VFlsERT3FdZBFvyvUy49nTuw40
   [***.***.***.***]: "<!DOCTYPE html>\n<html>\n<head>\n    <meta
   charset=\"utf-8\">\n    <title>Phoenix.Router.NoRouteError at GET
   /.well-known/acme-challen"

Phoenix error:

[info] GET /.well-known/acme-challenge/AmMMHM5SRA-EBC9u7VFlsERT3FdZBFvyvUy49nTuw40
[debug] ** (Phoenix.Router.NoRouteError) no route found for GET /.well-known/acme-challenge/AmMMHM5SRA-EBC9u7VFlsERT3FdZBFvyvUy49nTuw40 (ExchatWeb.Router)
    (exchat 0.1.0) lib/phoenix/router.ex:402: ExchatWeb.Router.call/2
    (exchat 0.1.0) lib/exchat_web/endpoint.ex:1: ExchatWeb.Endpoint.plug_builder_call/2
    (exchat 0.1.0) lib/plug/debugger.ex:136: ExchatWeb.Endpoint."call (overridable 3)"/2
    (exchat 0.1.0) lib/exchat_web/endpoint.ex:1: ExchatWeb.Endpoint.call/2
    (phoenix 1.5.12) lib/phoenix/endpoint/cowboy2_handler.ex:65: Phoenix.Endpoint.Cowboy2Handler.init/4
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_handler.erl:37: :cowboy_handler.execute/2
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_stream_h.erl:306: :cowboy_stream_h.execute/3
    (cowboy 2.9.0) /home/username/exchat/deps/cowboy/src/cowboy_stream_h.erl:295: :cowboy_stream_h.request_process/3
    (stdlib 3.15.2) proc_lib.erl:226: :proc_lib.init_p_do_apply/3

How about you try making a trivial mytestfile text file in .well-known and try accessing it over http?

I’m not even sure how to create a text file in .well-known inside Phoenix’s system. It’s not like the normal linux system that I am used to where you can just mkdir .well-known and vim mytestfile inside it. ‘.well-known’ inside phoenix isn’t even part of the linux filesystem for the certbot call. There are no tutorials or examples online (that I’ve found) for setting up LetsEncrypt on a subdomain / proxy pass system in apache.

Ok, I did a little searching and came across your earlier post: Serving .well-known/apple-app-site-association Works in Development env but returns Phoenix.HTML.Safe error in Release - #3 by maz

So I was able to add a directory:

/assets/static/.well-known/test.txt
/assets/static/.well-known/acme-challenge/test.txt

I’m still getting this error when running certbot:

[info] GET /.well-known/acme-challenge/_B_tSrUELGkILDnSgQJJxj6FHSVsW5zmiHx3T_dTGV4
[debug] ** (Phoenix.Router.NoRouteError) no route found for GET /.well-known/acme-challenge/_B_tSrUELGkILDnSgQJJxj6FHSVsW5zmiHx3T_dTGV4 (ExchatWeb.Router)