非PHP/非静态文件网站的Let's Encrypt Certbot-auto webroot-path配置咨询

Great question! The core idea behind --webroot-path is simple: it needs to point to a directory where Certbot can drop ACME challenge files, and those files must be publicly reachable at http://yourdomain/.well-known/acme-challenge/ via Apache. Since your backend app (Node.js/Flask/Bottle) is being proxied or served via mod_wsgi, you don't need to tie this to your app's code directory—instead, use a dedicated directory that Apache can directly serve.

Here's how to handle each scenario:

1. Reverse Proxy Setup (Node.js/Flask/Bottle behind Apache) #

This is the most straightforward approach. We'll configure Apache to handle the ACME challenge requests directly, bypassing your backend app entirely:

• Step 1: Create a dedicated directory for challenge files (choose any path you like; this example uses /var/www/letsencrypt):

  sudo mkdir -p /var/www/letsencrypt/.well-known/acme-challenge
  sudo chown www-data:www-data /var/www/letsencrypt
  sudo chmod 755 /var/www/letsencrypt
  

• Step 2: Add an Alias to your Apache virtual host config (e.g., /etc/apache2/sites-available/example.com.conf):

  # Add this BEFORE your ProxyPass/ProxyPassReverse directives
  Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
  <Directory /var/www/letsencrypt/.well-known/acme-challenge/>
      Require all granted
      # No need for mod_wsgi or proxy here—Apache serves these files directly
  </Directory>
  
  # Your existing proxy config (example for Node.js)
  ProxyPass / http://localhost:3000/
  ProxyPassReverse / http://localhost:3000/
  

• Step 3: Restart Apache to apply changes:

  sudo systemctl restart apache2
  

• Step 4: Run Certbot with the new webroot path:

  ./certbot-auto certonly --webroot --webroot-path /var/www/letsencrypt/ --domain example.com --domain www.example.com --email a@example.com
  

2. mod_wsgi Setup (Flask/Bottle) #

For apps deployed via mod_wsgi, you have two options:

Option A: Use the dedicated directory approach (recommended) #

Follow the exact same steps as the reverse proxy scenario above. Adding the Alias to your Apache config lets Apache serve the challenge files directly, which is simpler than modifying your Flask/Bottle app.

Option B: Handle challenges in your Flask/Bottle app (advanced) #

If you prefer to let your app handle the ACME requests, you'll need to add a route to serve the challenge files. However, this requires you to manually place the challenge files in a location your app can access, or integrate an ACME client library into your app. For most cases, Option A is easier and less error-prone.

Key Notes: #

• Never use your app's code directory as the webroot unless Apache is directly serving static files from it (which isn't typical for mod_wsgi/proxy setups).
• Ensure the webroot directory has proper permissions so Apache can read the files Certbot creates.

内容的提问来源于stack exchange，提问作者Basj