AutoSSL Validation Failures: Check Routing Before Rewrite Changes

A failed AutoSSL HTTP validation can be caused by routing, but the error log must identify the actual request before you change rewrite rules. Excluding every .txt or .tmp request from application rules is not a safe general solution.

Identify the request and response

Read the account’s AutoSSL error or the administrator’s log. Record the exact hostname, validation method, request path and returned status. Verify public A/AAAA records and whether a CDN, proxy or different virtual host answers the request. A working homepage does not prove the validation path is reachable.

Check the layers in order

• DNS: confirm that all relevant public answers lead to the intended validation endpoint.
• Proxy/security: determine whether authentication, a bot challenge or an access rule blocks the request before it reaches the application.
• Routing: inspect redirects and front-controller rules. A loop, an unrelated HTML page or a login screen is not a successful challenge response.
• Issuer policy: check the reported CAA or rate-limit error rather than attempting a rewrite fix for a non-routing failure.

Make a narrow, reversible correction

Back up the relevant configuration first. For an HTTP challenge, arrange for the actual validation path to return the expected token using the panel/ACME client’s documented handling. Limit any exception to that path and intended host, not a broad filename extension or the entire website. Apache, a reverse proxy and a CDN may require different changes, so there is no universal .htaccess snippet here.

For DNS validation, fix the required record and authorization instead; an HTTP rewrite exemption cannot solve it. Keep ordinary authentication and security controls on other paths.

Verify before retrying repeatedly

Confirm the exact challenge response and logs, then make a controlled AutoSSL retry. Verify that the installed certificate includes the required names and that normal private routes remain protected. Remove temporary changes that the supported validation workflow no longer needs. Do not publish private keys or unrelated configuration secrets in a support ticket.

References: HTTP and DNS challenge behavior; AutoSSL logs and account checks.

Reviewed October 14, 2026. No production rewrite, DNS, CDN or security rule was changed.