Zero Trust - LetsEncrypt

[martin-m]

Hello,
I use cloudflare Zero Trust for my domains.
And I use LetsEncrypt on some servers. Unfortunately, when Zero Trust is enabled, certificate renewal via LetsEncrypt does not work.

Is there any way for path:
*example.com/.well-known/acme-challenge/*

Add it to the exceptions so that it is not covered by Zero Trust?

If this is possible, please provide a procedure on what needs to be done to do this.

I have a free subscription.

Thanks,

Martin

[erictung]

Perhaps you can try this method, shared by other community members?

Cloudflare Access? Exclude Path from authentication?

I figured it out. You have to create two applications, a normal one with the bare domain/sub-domain without a path, which will have the policy to grant access. Then, you create a second application which specifies a path, shown in the screenshot. This application should have one bypass policy, also in the screenshot. [i_view64_cfLO9QAb2s] It’s a bit clunky, but works great.

[martin-m]

Thank you for the answer and the method @erictung .
Could you give me more advice. I am new to CF so I am not quite sure what all needs to be set up.

Do I understand correctly that in CF → Security → WAF - I create a new rule?

See printscreen

Unfortunately that’s probably not all, it’s still not working.

Thanks,

[erictung]

Nothing related to the WAF/Firewall rule for your domain.

You need to create another Cloudflare Access application in Zero Trust dashboard, to match the specific path that you would like to skip authentication for Let’s Encrypt cert renewal. Within the new Access application, the Access policy action should be Bypass everyone.

[shawaj]

I can confirm that this worked for me with following settings…

[shawaj]

And the acess rule is…

[shawaj]

I forgot to add this screenshot too (sorry for multiple posts, but it wont let me post more than one picture per post!)…