# AutoSSL / ACME HTTP DCV fix for testmarketplace.aibitsoft.cloud

## Problem
AutoSSL was failing with:
- **HTTP DCV:** 404 when requesting `http://testmarketplace.aibitsoft.cloud/.well-known/acme-challenge/...`
- **DNS DCV:** No local authority

## Status: www validated, apex may use DNS

If **www.testmarketplace.aibitsoft.cloud** shows “AutoSSL Domain Validated” but **testmarketplace.aibitsoft.cloud** (no www) shows a **DNS DCV** error (e.g. “NXDOMAIN looking up TXT for _acme-challenge.testmarketplace.aibitsoft.cloud”):

- The certificate issued for **www** often **covers the apex** as well (same cert, multiple names). Check in cPanel **SSL/TLS Status** whether the cert lists both `testmarketplace.aibitsoft.cloud` and `www.testmarketplace.aibitsoft.cloud`.
- If the apex still shows as self-signed or failing:
  1. **Run AutoSSL again** – sometimes the apex validates via HTTP on a retry.
  2. If AutoSSL keeps using **DNS DCV** for the apex, add the TXT record it requests: in your DNS (cPanel **Zone Editor** or your DNS host), create a TXT record for **`_acme-challenge.testmarketplace.aibitsoft.cloud`** with the value AutoSSL shows (in the error or in the AutoSSL/SSL UI). Then run AutoSSL again before the value expires.

## Fix applied (Laravel app)

This app has two possible document roots in cPanel. **Set the domain’s document root** to one of these and keep it consistent:

### Option A: Document root = **project root** (`testmarketplace.aibitsoft.cloud`)

- **`.well-known/acme-challenge/`** exists in the project root. AutoSSL writes the token here.
- **Project root `.htaccess`** rewrites `/.well-known/acme-challenge/TOKEN` to `serve-acme-testmarketplace.php?token=TOKEN`, which reads the file and outputs it (so DCV works even if static files are not served).
- **`serve-acme-testmarketplace.php`** in the project root serves the challenge file.

### Option B: Document root = **public** (`testmarketplace.aibitsoft.cloud/public`)

- **`public/.well-known/acme-challenge/`** was created. AutoSSL writes the token here.
- **`public/.htaccess`** has a pass-through for `/.well-known/` so the challenge file is served before the Laravel front controller.

### If testmarketplace is served by the main domain vhost (DocumentRoot = `public_html`)

- In **public_html**, a rewrite sends `Host: testmarketplace.aibitsoft.cloud` requests for `/.well-known/acme-challenge/TOKEN` to **`serve-acme-testmarketplace.php`** in public_html, which reads from **this** project’s `.well-known/acme-challenge/` and outputs it.

---

## Rebuild httpd and restart Apache (required for userdata Include)

If you already deployed **`apache-acme.conf`** to userdata, cPanel does **not** apply new userdata files until the main Apache config is rebuilt. Run as **root**:

```bash
/usr/local/cpanel/scripts/rebuildhttpdconf
/usr/local/cpanel/scripts/restartsrv_httpd
```

(or `restartsrv_apache` if your server uses that). Then run AutoSSL again.

---

## If you haven’t yet: deploy the Apache Include

1. Copy **`apache-acme.conf`** into userdata for **both** HTTP and HTTPS:

```bash
mkdir -p /etc/apache2/conf.d/userdata/std/2_4/aibitsofts/testmarketplace.aibitsoft.cloud
mkdir -p /etc/apache2/conf.d/userdata/ssl/2_4/aibitsofts/testmarketplace.aibitsoft.cloud
cp /home/aibitsofts/public_html/testmarketplace.aibitsoft.cloud/apache-acme.conf \
   /etc/apache2/conf.d/userdata/std/2_4/aibitsofts/testmarketplace.aibitsoft.cloud/acme.conf
cp /home/aibitsofts/public_html/testmarketplace.aibitsoft.cloud/apache-acme.conf \
   /etc/apache2/conf.d/userdata/ssl/2_4/aibitsofts/testmarketplace.aibitsoft.cloud/acme.conf
```

2. **Rebuild and restart** (required so the Include is applied):

```bash
/usr/local/cpanel/scripts/rebuildhttpdconf
/usr/local/cpanel/scripts/restartsrv_httpd
```

3. Confirm document root in cPanel for **testmarketplace.aibitsoft.cloud** and **www** is `public_html/testmarketplace.aibitsoft.cloud`.

4. Run **AutoSSL** again in cPanel for both hostnames.

---

## Optional check

After AutoSSL has run and created a challenge file:

```bash
curl -I http://testmarketplace.aibitsoft.cloud/.well-known/acme-challenge/TOKEN
```

A real challenge file should return **200**. **404** for a non-existent or expired token is normal.

---

## What’s in this folder

- **`.well-known/acme-challenge/`** (project root) – Real directory; AutoSSL writes the token here when document root is the project root. Do not replace with a symlink.
- **`public/.well-known/acme-challenge/`** – Same for when document root is `public/`.
- **`.htaccess`** – Rewrites `/.well-known/acme-challenge/TOKEN` to `serve-acme-testmarketplace.php` so the challenge is served even if static files are not.
- **`serve-acme-testmarketplace.php`** – Reads the token from this folder’s `.well-known/acme-challenge/` and outputs it.
- **`apache-acme.conf`** – Optional Apache Include to Alias `/.well-known` to this path; use after `rebuildhttpdconf` if needed.