What does authenticator for Apache plugin from Certbot actually do for “http-01” challenge?

Question

When using Let’s Encrypt via the Certbot software, you can use the Apache plugin to obtain and install certificates on your Apache web server.

With the “http-01” challenge, which is probably the most popular way to verify your ownership of the domain, the authenticator must somehow serve a file in the directory /.well-known/acme-challenge via HTTP on port 80.

But how does Certbot actually do this in an automated way, from a technical perspective?

It seems that Certbot neither changes your virtual host configuration nor the actual contents of the document root for the virtual host.

So how does Certbot technically accomplish its task of serving the file at the required location?

Answer 1

The plugin's configurator.py's perform() calls another perform() in http_01.py file. This creates the challenge files in the configured challenge directory, distinct from the document root (_set_up_challenges() includes code to check whether the directory exists and create it). _mod_config() then handles serving:

1. Finds or creates a VirtualHost that listens on the configured port and loads configuration data from files (self._set_up_include_directives(vh)).
2. Uses the reverter's register_file_creation() to register the creation of temporary _pre and _post rule files (this does not write them, but ensures their deletion if there is a later error).
3. Selects and fills in the configured path of the internal challenge directory in the appropriate pair of CONFIG_TEMPLATEs for the configurator being used (e.g., CONFIG_TEMPLATE22_PRE) - htaccess rules where the _PRE is a redirect pointing requests for .wellknown/acme-challenge/[TOKEN] to the the challenge directory and the the _POST grants access to both /.wellknown/acme-challenge/ and the challenge directory. Each of these is written to the previously registered location.
4. Declares setup complete and returns.

So yes, a temporary configuration change to redirect requests to a custom directory path.