Unable to prove website when "/.well-known/keybase.txt" gives a 403 header

[jtdroste]

Hi there,

KeyBase profile: https://keybase.io/jtdroste
Web File Proof: https://james.droste.im/keybase.txt

I can't seem to get KeyBase to accept my proof. It's there, and I don't believe there are any errors with my certificate. Is there any reason why it's not working? I tried using the CLI client as well as the website to do it.

---

Update: Seems that because /.well-known/keybase.txt was returning a 403 http status code, the proving engine does not bother checking /keybase.txt

[zQueal]

Two issues here.

One, keybase verifies the top level domain, not sub domains. Meaning it will verify droste.im and not james.droste.im.

Two, the directory path that keybase will check is: droste.im/.well-known/keybase.txt

If you haven't already, ensure that you've created the .well-known directory and store your proof there.

[malgorithms]

hey @Xanza, actually those 2 issues should both be fine. (1) we recently made the .well-known directory optional since a lot of users couldn't set it up on their Wordpress and other sites. Also, (2) we do support subdomain proving.

See this user as an example of someone who is doing subdomain proofs and uses just a top level keybase.txt:

• https://keybase.io/nicolaslegland
• https://www.nicolas.legland.fr/keybase.txt

@jtdroste the problem might be that .well-known/ takes priority over the top level when both exist, and you're serving a 403 instead of a 404 on the .well-known directory. So it could be it's calling an error on the first thing it's trying and not looking at the second option. But I'm not sure. @maxtaco would have to tell us what happens in the 403 case.

If you can, try getting it to work in .well-known or try getting .well-known/keybase.txt to 404.

[malgorithms]

and you're serving a 403 instead of a 404 on the .well-known directory.

correction: you're serving a 403 on .well-known/keybase.txt -- it doesn't matter what you serve on the directory itself.

Again, this is just a theory.

[jtdroste]

@malgorithms just checked and you are indeed correct! I removed the nginx rules blocking access to files/directories starting with a dot, and verification worked!

Possibly something to change in the web verification part?

[jtdroste]

Updated the ticket name with the real issue

[malgorithms]

oh great! yeah, I think if you 403-forbidden the first location, maybe the second should still work...have to think about that.

[maxtaco]

This could be a bug:

https://github.com/keybase/proofs/blob/master/src/scrapers/generic_web_site.iced#L67

This list doesn't contain v_codes.PERMISSION_DENIED, which we recently broke out as a separate code.

[maxtaco]

That's a bug fix, I can't push it live from where I am (the upstream firewall is blocking port 22).

[zQueal]

(1) we recently made the .well-known directory optional since a lot of users couldn't set it up on their Wordpress and other sites. Also, (2) we do support subdomain proving.

Thanks, I wasn't aware of these changes.

[maxtaco]

I just pushed the fix live. Hopefully it won't explode this same way in the future.