[HOWTO] Let's Encrypt

Seems like creating a chroot to serve the various required acme challenges for your domains would be a nice addition to this. Just set a folder path for your virtual sites for the well known acme challenge requests to route to the utm real web server setup setup for that domains challenge. That way there wouldn't be any need to mess with network mounts/ssh, etc.

Only thing I'm not sure about with such an approach though is if the web server protection module would actually be able to handle such a task.  I say this because I tried once to setup a virtual web server for the utm web admin site itself, thus allowing me to point utm.domain.com to the utm web admin site (obviously not secure Yea but that's not the point I'm making here).  The idea was to let me hit the admin site via 443 while still being able to have other sites rerouted though the utm as well.  Problem is, I noticed in the logs the redirect internally was to the local loop back address, and utm web admin settings doesn't let you allow local loop back as an allowed interface to connect to it.  Thus I suspect trying to do the same for acme challenges might run into the same challenge, so perhaps a secondary web server on an internal vm somewhere could point back to the utm address/port for serving up the response for that domain.

Thoughts?

EDIT:  Ahhh, DNS-01 challenges was the key.

Seems like creating a chroot to serve the various required acme challenges for your domains would be a nice addition to this. Just set a folder path for your virtual sites for the well known acme challenge requests to route to the utm real web server setup setup for that domains challenge. That way there wouldn't be any need to mess with network mounts/ssh, etc.

Only thing I'm not sure about with such an approach though is if the web server protection module would actually be able to handle such a task.  I say this because I tried once to setup a virtual web server for the utm web admin site itself, thus allowing me to point utm.domain.com to the utm web admin site (obviously not secure Yea but that's not the point I'm making here).  The idea was to let me hit the admin site via 443 while still being able to have other sites rerouted though the utm as well.  Problem is, I noticed in the logs the redirect internally was to the local loop back address, and utm web admin settings doesn't let you allow local loop back as an allowed interface to connect to it.  Thus I suspect trying to do the same for acme challenges might run into the same challenge, so perhaps a secondary web server on an internal vm somewhere could point back to the utm address/port for serving up the response for that domain.

Thoughts?

EDIT:  Ahhh, DNS-01 challenges was the key.