Docs

Path Rules for /.well-known/

The Restriction

On a domain that isn’t a wildcard (*.example.com), the Path Rules > Allow and Path Rules > Block pages refuse any path containing well-known, with or without the leading dot, for every match type.

Why It Exists

Your SSL certificate renews by answering a check at /.well-known/acme-challenge/, and the WAF answers that check itself. An allow rule sends the check to your application instead, and a block rule answers it with a 403. Either one stops the renewal from verifying your domain. The certificate then expires without being replaced, and visitors see a security warning.

Allowing One Specific File

Services such as Apple Pay and Android App Links read files under /.well-known/. Most of these files need no rule at all.

If your WAF logs show one of these files being blocked, contact support and we’ll add a rule that matches only that file. A rule for one exact file doesn’t affect your certificate renewal.

Don’t allow the file name with a Contains rule instead. An allow rule skips WAF checks for every URL it matches, and Contains matches anywhere in the URL, including the query string, so anyone could skip those checks on any page by adding the file name to the URL.

While HTTP Flood (DDoS) Protection is set to Filtering, a service that can’t run javascript can be stopped with no log entry, and an allow rule doesn’t get it past that check. Set the protection to Not Filtering while the service verifies your file.

Blocking One Specific File

Contact support and we’ll add a rule that matches only that file. We add these one file at a time, because a rule covering all of /.well-known/ stops your certificate from renewing.

If You Already Have a Rule

Rules added before this restriction stay in place until someone removes them.

A rule naming one specific file doesn’t affect renewal, and you can leave it alone. Remove any rule that covers all of /.well-known/ from its Path Rules page before your certificate’s next renewal. If you have a rule for /.well-known/acme-challenge/, contact support before removing it so we can check whether your application depends on it.

Don’t shorten a path to get it past the form. A Begins With rule for /.well still matches the renewal check and can stop it, and an allow rule for acme-challenge skips WAF checks for any URL containing that text.

Wildcard Domains

Wildcard domains have a specific setup that works with our certificate infrastructure, so this restriction doesn’t apply to them. That setup usually includes a block rule for well-known. Leave that rule in place.

Using Your Own SSL Certificate

If you supply your own certificate, the renewal check above doesn’t apply to it, but the dashboard still refuses these paths. Contact support if you need one of these rules added.

Need Help?

If you have trouble with any of these rules, contact support: