# Apache first or certbot first? **URL:** \ **Category:** Server\ **Created:** [November 28, 2017, 3:10pm UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227 "2017-11-28T15:10:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![amwink](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/amwink/32/18313_2.png) [@amwink](https://community.letsencrypt.org/u/amwink)\ **Post date:** [November 28, 2017, 3:10pm UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227/1 "2017-11-28T15:10:32Z")
My debian(8) host has an Apache2 web server that connects to a tomcat backend. At the moment it is configured for http only. For security I want to exclusively use https and installed the certbot package to set up SSL first, then Apache2. When I run $ certbot --apache --domains [rng-xnat.ecloud.vumc.nl](http://rng-xnat.ecloud.vumc.nl) I get an error about the first challenge (tls-sni-01): Saving debug log to /var/log/letsencrypt/letsencrypt.log Starting new HTTPS connection (1): [acme-v01.api.letsencrypt.org](http://acme-v01.api.letsencrypt.org) Obtaining a new certificate Performing the following challenges: tls-sni-01 challenge for [rng-xnat.ecloud.vumc.nl](http://rng-xnat.ecloud.vumc.nl) Enabled Apache socache\_shmcb module Enabled Apache ssl module /usr/lib/python2.7/dist-packages/OpenSSL/rand.py:58: UserWarning: implicit cast from ‘char \*’ to a different pointer type: will be forbidden in the future (check that the types are as you expect; use an explicit ffi.cast() if they are correct) result\_code = \_lib.RAND\_bytes(result\_buffer, num\_bytes) Waiting for verification… Cleaning up challenges Failed authorization procedure. [rng-xnat.ecloud.vumc.nl](http://rng-xnat.ecloud.vumc.nl) (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Timeout IMPORTANT NOTES: - The following errors were reported by the server: I have the ssh, http and https ports open in the firewall and I can open the site in my browser, so I’m not sure why certbot fails to connect to my host? ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [November 28, 2017, 3:21pm UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227/2 "2017-11-28T15:21:57Z")
> [@amwink](#): > > I have the ssh, http and https ports open in the firewall and I can open the site in my browser > $ telnet rng-xnat.ecloud.vumc.nl 443 > Trying 154.121.54.181... > ^C > $ telnet rng-xnat.ecloud.vumc.nl 80 > Trying 154.121.54.181... > ^C From my point of view, I cannot connect to your host via http/https. ---
**Author:** ![amwink](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/amwink/32/18313_2.png) [@amwink](https://community.letsencrypt.org/u/amwink)\ **Post date:** [November 29, 2017, 8:55am UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227/3 "2017-11-29T08:55:27Z")
Thanks! I found the same on a website from outside my workplace’s domain. IP address works, hostname doesn’t. Will need to call the IT department for that. For the firewall options i have ports 22, 80, 443 and 8080 open. From inside the domain I can do all those telnet options, EXCEPT port 443. It says: connection refused. But as I said in my first post, I started setting up SSL because the Apache setup for HTTPS requires the SSL certificates to already be there? So this feels a bit like a catch-22: to get SSL I need Apache2 to already work for port 443, but to get it working I need the SSL certificate. I get the feeling that I am missing something, probably something basic. ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [November 29, 2017, 9:05am UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227/4 "2017-11-29T09:05:53Z")
> [@amwink](#): > > I get the feeling that I am missing something, probably something basic. You don't need to setup SSL beforehand. Look at the webroot-plugin, which places the challenge files for http-01 authentication at a user-configurable place. Or use apache-plugin which automagically configures Apache during authorization and may even setup Apache for SSL after certificate issuance. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [December 29, 2017, 9:06am UTC](https://community.letsencrypt.org/t/apache-first-or-certbot-first/47227/5 "2017-12-29T09:06:12Z")
Closed on December 29, 2017, 9:06am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.