So, one of my servers is behind NAT, and since there is already a publicly accessible apache server going on my LAN, I decided to access it from the outside with different ports, and remap them to the standard port of the apache on this new machine I want to get a cert on. I did that with classic port forwarding via my router.

Now, if I want to use letsencrypt on said server, it obviously fails because it tries to use the standard port, which will direct to my other server's apache installation (which btw. already has a letsencrypt-cert).

Now I guess I need some way to tell letsencrypt to use my self-defined port instead of the standard one to connect from the outside, but I haven't found anything yet. Is that even possible? If it is, how?

  • If you already have a key and certificate for your hostname, why don't you use that on both servers? As you have noticed the outside world will treat them as one anyway :) – Sander Steffann Jan 18 '16 at 11:08
  • I didn't want to do that because the machines really do completely different things, are also on different domains and it would be an impact on the automation side of things to share their certs, right? – Lollen Jumplan Jan 18 '16 at 13:43
  • Yeah, if they use different hostname then you need separate certificates. For the letsencrypt verification you could put the verification file on the other server that runs on port 80 – Sander Steffann Jan 18 '16 at 14:46

It's not possible to use non-standard port, as conforming ACME server will still try to contact default 80 / 443 for http-01 / tls-sni-01 challenges.

E.g.certbot has a separate options for to listen to non-standard port, but that still doesn't help to pass the challenge:

        Options for modifying how a cert is obtained

        --tls-sni-01-port TLS_SNI_01_PORT
                              Port used during tls-sni-01 challenge. This only
                              affects the port Certbot listens on. A conforming ACME
                              server will still attempt to connect on port 443.
                              (default: 443)
        --http-01-port HTTP01_PORT
                              Port used in the http-01 challenge.This only affects
                              the port Certbot listens on. A conforming ACME server
                              will still attempt to connect on port 80. (default:

Probably in your case the best way would be to use another verification method -- webroot. In this case you don't need your 80 and 443 to be available to the outside world, but just a specific directory (which might be configured with proxy on webserver side, I assume).

Details are available here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.