challenges fail when using 301 redirects #428

New Issue

adam · 2025-12-29T01:25:00+01:00

adam commented

2025-12-29 01:25:00 +01:00

Originally created by @Wurzelmann on GitHub (Aug 31, 2019).

I've been using dehydrated for about a year now, without problems, but now challenges for domains which use a 301/302 redirect fail.

Example fail:

ERROR: Challenge is invalid! (returned: invalid) (result: {
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "Invalid response from https://twitter.com/XXXXXXXXXXXXXXXX [104.244.42.1]:     \"\u003c!DOCTYPE html\u003e\\n\u003chtml lang=\\\"en\\\" data-scribe-reduced-action-queue=\\\"true\\\"\u003e\\n  \u003chead\u003e\\n    \\n    \\n    \\n    \\n    \\n    \\n    \\n    \u003cmeta c\"",
"status": 403},

This occurs when my domain uses a 301 redirect to another one (e.g. twitter.com in this example), but hasn't been a problem ever before.

OS: Debian stable (10.0)
dehydrated version: 0.6.5-1~bpo10+1

Originally created by @Wurzelmann on GitHub (Aug 31, 2019). I've been using dehydrated for about a year now, without problems, but now challenges for domains which use a 301/302 redirect fail. Example fail: ERROR: Challenge is invalid! (returned: invalid) (result: { "type": "http-01", "status": "invalid", "error": { "type": "urn:ietf:params:acme:error:unauthorized", "detail": "Invalid response from https://twitter.com/XXXXXXXXXXXXXXXX [104.244.42.1]: \"\u003c!DOCTYPE html\u003e\\n\u003chtml lang=\\\"en\\\" data-scribe-reduced-action-queue=\\\"true\\\"\u003e\\n \u003chead\u003e\\n \\n \\n \\n \\n \\n \\n \\n \u003cmeta c\"", "status": 403}, This occurs when my domain uses a 301 redirect to another one (e.g. twitter.com in this example), but hasn't been a problem ever before. OS: Debian stable (10.0) dehydrated version: 0.6.5-1~bpo10+1

adam closed this issue

2025-12-29 01:25:00 +01:00

adam commented

2025-12-29 01:25:01 +01:00

@lukas2511 commented on GitHub (Sep 2, 2019):

I'm not sure how this would ever have worked before. How would the CA validate your tokens if you don't serve them but instead redirect to Twitter?

@lukas2511 commented on GitHub (Sep 2, 2019): I'm not sure how this would ever have worked before. How would the CA validate your tokens if you don't serve them but instead redirect to Twitter?

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#428