I have a lot of problems with SSL auto-renewal with nGinx. I use URLRewrite a lot, and to update the SSL, I need to remove the settings, have the SSL updated, and then go back to the settings again. When you have few sites, OK, but this is unfeasible when you have many! I would like to know if there is a solution for this, or ask them to put it in the update script, so that the script momentarily moves to a ".tmp" file with the current Rewrite settings, and only after finishing the update, it returns to default. .. It's possible?

thiagotgc Hello, using URL rewrite generally does not affect updating SSL. The panel automatically updates SSL at 10 am every day, which can be seen in cron. What is your URL rewrite?

aaPanel_Kern So something is wrong with the latest versions. I can only update the SSL, after removing everything I have in Rewirte....

thiagotgc No changes have been made to applying for SSL. Please check domain resolution before applying, unresolved domain leads to audit failure. The certificate is valid for 3 months, supports wildcard domain. Auto-renew by default. If you uses CDN or redirect, you may not be able to apply and renew through file verification. When you do not specify a SSL default site, if you use HTTPS to access a site that does not have SSL enabled, you will directly access a site that has SSL enabled

aaPanel_Kern I don't think you understand! Everything is ok and working on my website. The renewal works, but because of some rules I have in my Rewrite, it generates an error, and the renewal is not done. That's why I asked to check if it's possible to disable Rewrite before renewing. That way there would be no errors.

thiagotgc Hello, what is the content in your URL rewrite? Is the whole site jump configured? Maybe using DNS authentication is more suitable for you.

My URL rewrite: # Especifique como lidar com diretórios - especificando index index.php index.html /index.php$request_uri; # Definir tamanho máximo de upload client_max_body_size 0; # Regra para lidar com well-known location ^~ /.well-known { location = /.well-known/carddav { return 301 $scheme://$host/remote.php/dav; } location = /.well-known/caldav { return 301 $scheme://$host/remote.php/dav; } location ^~ /.well-known { return 301 /index.php$uri; } try_files $uri $uri/ =404; } # location / { # rewrite ^ /index.php$uri; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-Proto $scheme; # proxy_set_header X-Forwarded-Port 443; # proxy_set_header Host $host; #} location ~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/) { try_files $uri $uri/ =404; index index.php; } # Regra para lidar com clientes Microsoft DAV location = / { if ( $http_user_agent ~ ^DavClnt ) { return 302 /remote.php/webdav/$is_args$args; } } # Ative o gzip, mas não remova os cabeçalhos ETag gzip on; gzip_vary on; gzip_comp_level 4; gzip_min_length 256; gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; # Paginas de erro # error_page 403 /core/templates/403.php; # error_page 404 /core/templates/404.php; # Regras emprestadas de `.htaccess` para ocultar certos caminhos de clientes location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } # Certifique-se de que este bloco, que passa arquivos PHP para o processo PHP, esteja acima dos blocos # location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+|core/templates/40[34])\.php(?:$|/) { location ~ \.php(?:$|/) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; set $path_info $fastcgi_path_info; try_files $fastcgi_script_name =404; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $path_info; fastcgi_param HTTPS on; fastcgi_param modHeadersAvailable true; # Evite enviar os cabeçalhos de segurança duas vezes fastcgi_param front_controller_active true; # Habilitar urls bonitos # fastcgi_pass php-handler; fastcgi_intercept_errors on; fastcgi_request_buffering off; fastcgi_max_temp_file_size 0; } # Location das paginas location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ { try_files $uri /index.php$request_uri; expires 6M; # Política de controle de cache emprestada de `.htaccess` access_log off; # Opcional: não registre o acesso aos ativos fastcgi_buffers 64 4K; fastcgi_ignore_headers X-Accel-Buffering; fastcgi_hide_header X-Powered-By; } location ~ \.woff2?$ { try_files $uri /index.php$request_uri; expires 7d; # Política de controle de cache emprestada de `.htaccess` access_log off; # Opcional: não registre o acesso aos ativos } location /remote { return 301 /remote.php$request_uri; } location / { try_files $uri $uri/ /index.php$request_uri; } # Location das paginas para cache location ~ \.(?:css|js)$ { try_files $uri /index.php$uri$is_args$args; add_header Cache-Control "max-age=15778463" always; } location ~ \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg|map|json)$ { try_files $uri /index.php$uri$is_args$args; add_header Cache-Control "public, max-age=7200" always; } if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); }

thiagotgc Hi, this is already obvious: location ^~ /.well-known { return 301 /index.php$uri; } When accessing .well-known, it is directly rewritten to index.php and cannot be verified.

aaPanel_Kern Correct! Even removing only this line, the SSL is not generated, prrciso practically remove it! But I need the rules on many servers. I believe I'm not the only one! Don't you think it's convenient to temporarily disable rewirte when generating ssl?

thiagotgc Hello, do not consider disabling rewirte when applying. We don't know how the user will set it up, the user environment is very complex. Not necessarily set in URL rewrite. Like this, should use DNS authentication

Automatically renew SSL certificate problem...

aaPanel_Kern

thiagotgc
Hello, thank you for your suggestion, we will not consider this for now.
If Rewrite is set, SSL cannot be generated. Please use DNS to verify.

« Previous Page