Certbot Renewal Clarification

[mayesca]

Hi, so before anything, I understand this question is slightly peculiar in that its more theoretical; As you can see from the answers at the bottom of this post, I have not used certbot yet. This is due to the following.

• tls-alpn-01 challenge is unsupported via the client (cannot open up port 80 and I’m not sure about requesting a cert using the DNS challenge over port 443)

• Our ansible version is currently 2.3 and the “acme_challenge_cert_helper” Ansible module is new in v2.7 (I do not have the access to upgrade our version)
  https://docs.ansible.com/ansible/latest/modules/acme_challenge_cert_helper_module.html#acme-challenge-cert-helper-module

So I’m more just trying to gather a framework and plan for how I want to implement automating requesting, generating, and renewing our certs.

QUESTION
If I am able to obtain a certificate by fulfilling the tls-alpn-01 challenge via a task using the Ansible module above, will I be able to renew the cert via certbot even though the tls-alpn-01 challenge is not supported? I’m not sure if the whole challenge validation process is started for renewal or not and I can’t seem to find any direct answers.

I literally just started learning about SSL/TLS Certificate validation last week so please bear with me. If there is any additional information that would help in this inquiry please let me know.

My domain is: N/A

I ran this command: N/A

It produced this output: N/A

My web server is (include version): Apache

The operating system my web server runs on is (include version): CentOS/RHEL7

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): Will be the latest version

[Osiris]

@mayesca

(…) this question (…)

Could be me, but I'm not seeing any question?

[mayesca]

Sorry about that, my “question” got posted before I was done editing it. It should be up now.

[Osiris]

@mayesca

tls-alpn-01 challenge is unsupported via the client

Correct, certbot doesn't support the tls-alpn-01 challenge.

@mayesca

cannot open up port 80

That's unfortunate. So you're not running a public site then?

@mayesca

and I’m not sure about requesting a cert using the DNS challenge over port 443

The DNS challenge isn't "over" port 443. It's through the DNS system. It depends on how you can communicate to your DNS API. That might be over port 443. But that isn't set in stone.

@mayesca

• Our ansible version is currently 2.3 and the “acme_challenge_cert_helper” Ansible module is new in v2.7 (I do not have the access to upgrade our version)
  community.crypto.acme_challenge_cert_helper module – Prepare certificates required for ACME challenges such as tls-alpn-01 — Ansible Documentation

There is a Let's Encrypt module for Ansible 2.3: https://docs.ansible.com/ansible/2.3/letsencrypt_module.html Perhaps you can use it with the DNS challenge, as it also doesn't support the tls-alpn-01 challenge and you said port 80 isn't an option.

[mayesca]

We are running a public site but only allow certain IPs to the website for external testing purposes and are required to block port 80 at the firewall level. I’m assuming certbot does not support a custom port option?

Does the whole challenge fulfillment process get executed for renewing a cert via certbot?

[schoen]

@mayesca

I’m assuming certbot does not support a custom port option?

Certbot does, but the Let's Encrypt CA doesn't!

@mayesca

Does the whole challenge fulfillment process get executed for renewing a cert via certbot?

Yes, you have to repeat the challenges. So @Osiris's suggestion about DNS challenges may be helpful in your situation.

[mayesca]

Ok thank you very much!