vitya
3c7ca3416b
Stood up a permanent self-renewing Let's Encrypt pipeline on the RUVDS IIS host, replacing the manual traefik acme.json -> PFX import and closing the 2026-07-22 cert-expiry deadline (new 25-SAN cert valid to 2026-09-03, SYSTEM scheduled task renews 55 days before expiry). Key obstacle: the MoreThenCms OWIN catch-all (owin:HandleAllRequests) swallowed /.well-known/acme-challenge/. Solved by carving the challenge path into a separate IIS application in a No-Managed-Code app pool, plus patching win-acme's Web_Config.xml template to remove the inherited Owin handler. Staging + prod validation green for all 25 hostnames; live TLS smoke confirms the new cert is served (incl degraded maljarka/rimiz). - scripts/iis-migration-to-ruvds/03-ruvds-winacme.ps1 (idempotent setup) - scripts/iis-migration-to-ruvds/winacme-Web_Config.xml (patched template) - .wiki/concepts/winacme-iis-owin-catchall-http01.md (recipe + gotchas) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
983 B
XML
24 lines
983 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!--
|
|
win-acme HTTP-01 challenge web.config template (overwrites C:\win-acme\Web_Config.xml on RUVDS).
|
|
Patched for the MoreThenCms / OWIN catch-all: the .well-known/acme-challenge folder is a
|
|
separate IIS application in a "No Managed Code" app pool (acme-challenge). The inherited
|
|
catch-all Owin *managed* handler 500s in an unmanaged pool, so we <remove> it; tokens are
|
|
served by the native StaticFileModule with an extensionless mimeMap. See task decisions log.
|
|
-->
|
|
<configuration>
|
|
<system.webServer>
|
|
<httpRedirect enabled="false" />
|
|
<validation validateIntegratedModeConfiguration="false" />
|
|
<handlers>
|
|
<remove name="Owin" />
|
|
</handlers>
|
|
<modules runAllManagedModulesForAllRequests="false" />
|
|
<staticContent>
|
|
<clear />
|
|
<mimeMap fileExtension="." mimeType="text/json" />
|
|
<mimeMap fileExtension=".*" mimeType="text/json" />
|
|
</staticContent>
|
|
</system.webServer>
|
|
</configuration>
|