diff --git a/http/Provision/Config/Apache/server.tpl.php b/http/Provision/Config/Apache/server.tpl.php
index 5efa19db88811ad5557a5836a56b4e5402e5b29c..e6ea28abd6c77e70454146a908c663658ecbaf5f 100644
--- a/http/Provision/Config/Apache/server.tpl.php
+++ b/http/Provision/Config/Apache/server.tpl.php
@@ -5,7 +5,11 @@ NameVirtualHost *:<?php print $http_port; ?>
 
 <VirtualHost *:<?php print $http_port; ?>>
   ServerName default
-  Redirect 404 /
+
+  <IfModule mod_rewrite.c>
+    RewriteEngine on
+    RewriteRule ^(?!(/\.well-known/acme-challenge/.+)) - [R=404,L,NC]
+  </IfModule>
 </VirtualHost>
 
 
diff --git a/platform/deploy.provision.inc b/platform/deploy.provision.inc
index f77fa39da9d416ef29b056ac2f7acd6e13368416..86f056bb4d55e49b5eda16fb0f0ab654d7c6720a 100644
--- a/platform/deploy.provision.inc
+++ b/platform/deploy.provision.inc
@@ -67,6 +67,9 @@ function drush_provision_drupal_pre_provision_deploy($backup_file) {
     provision_file()->chgrp(drush_get_option('extract_path') . '/private/temp', d('@server_master')->web_group, TRUE)
       ->succeed('Changed group ownership of temp files in <code>@path</code> to @gid')
       ->fail('Could not change group ownership of temp files in <code>@path</code> to @gid');
+    provision_file()->chgrp(drush_get_option('extract_path') . '/private/config', d('@server_master')->web_group, TRUE)
+      ->succeed('Changed group ownership of config files in <code>@path</code> to @gid')
+      ->fail('Could not change group ownership of config files in <code>@path</code> to @gid');
 
     if (drush_get_option('deploy_replace_site', FALSE)) {
       $old = d()->site_path . '.restore';