2

When using the LetsEncrypt certbot to generate an SSL certificate for my domain, I am prompted to make a file available at my domain to verify my control at my domain:

http://example.com/.well-known/acme-challenge/XXXXXX

However when I try to upload that file to my Google Cloud Storage bucket I get the following error:

$ gsutil rsync -R . gs://example.com Building synchronization state... Starting synchronization Copying file://./.well-known/acme-challenge/XXXXXX [Content-Type=application/octet-stream]... BadRequestException: 400 ACME HTTP challenges are not supported. Does Google Cloud Storage expressly forbid URLs with "acme challenge" in the path? Is it possible to setup a LetsEncrypt certificate for a domain hosted at a Google Cloud Storage bucket?

5
  • 3
  • 1
    LOL: "Object names cannot start with .well-known/acme-challenge." Turns out you can verify your domain control for LetsEncrypt/certbot by creating a TXT record instead of creating and uploading the file: certbot.eff.org/docs/using.html#manual
    – maxm
    Mar 11, 2018 at 8:02
  • 2
    @maxm: The reason is that "my_bucket.storage.googleapis.com" is also a domain name, but it's not one for which you should be able to get a certificate. If you own the example.com domain and happen to use CNAME records to serve content from GCS, registering ownership of the domain is no problem, but for simplicity and consistency we simply ban that object name for all buckets. Mar 11, 2018 at 20:33
  • @BrandonYarbrough -- thanks, makes sense. I have found it quite difficult to setup SSL for a GCS bucket with a custom domain
    – maxm
    Mar 12, 2018 at 6:12
  • 1
    @BrandonYarbrough Now that GCS verifies the domain ownership it would be great to remove the restriction as it would then be possible to use certbot with Google Loadbalancer and GCS buckets more easily
    – dflorey
    Jun 13, 2018 at 10:22

1 Answer 1

3

We worked around this by exposing /.well-known/acme-challenge as an endpoint and storing the challenge at a different directory that is allowed by Cloud Storage. When LE hits that endpoint we retrieve the generated challenge from it's directory and serialize it in the response.

1
  • What does this exactly mean ? Should we change " bucketname CNAME c.storage.googleapis.com " temporarily ? Dec 21, 2021 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.