Closed gnanet closed 7 years ago
It is possible to secure webmail with the extension version 2.1.0 Plesk Onyx is minimal required version for the feature.
The problem is not solved for me with Plesk Onyx 17.8.11 and Let'sEncrypt extension version 2.6.1-398
I had to modify the template /usr/local/psa/admin/conf/templates/custom/webmail/webmail.php
(copied from default template /usr/local/psa/admin/conf/templates/default/webmail/webmail.php
) adding
<Directory "/usr/share/psa-roundcube/.well-known/acme-challenge">
AllowOverride FileInfo AuthConfig Limit
</Directory>
just before the </VirtualHost>
closing tag of the first vhost (not the SSL one, to be clear)
Then I launched /usr/local/psa/admin/sbin/httpdmng --reconfigure-all
and from them on I was able to generate certificates for webmail.*
Distributor ID: Ubuntu Description: Ubuntu 14.04.5 LTS Release: 14.04 Codename: trusty Plesk 12.5.30 Update 63 (this contains "A number of security enhancements." )
The full CLI error:
A quick look into the error.log of apache shows a Satisfy not allowed here
This can only happen with a too restrictive AllowOverride setting that controls the path /usr/share/psa-roundcube.
And ofcourse this setting is present twice in /etc/apache2/plesk.conf.d/roundcube.conf as AllowOverride FileInfo:
The question is: How did it worked before? Did plesk change the apache config template, and if yes, why? - NOTE: Plesk 12.5.30 Update 63 contains "A number of security enhancements." Is this Satisfy any that gets generated on line 152 of challenge.py needed?
WORKAROUND: create a /etc/apache2/plesk.conf.d/webmails/roundcube/00_letsencrypt.conf file with following content, and do an apache2ctl graceful