I’m developing my own websocket server. It works fine for ws (http) handshake, and now I want to go on, making secured handshake (https) via TLS 1.2. So I need a certificate with private key available to make it run. The websocket server is running standalone without any commercial internet servers, listening to port 80 for ws communication and 443 for https wss communication. The websocket server has a separate IP totally isolated of my web provider, but it will be accessed from a https web page.
Which certificate do I need to use and is it possible to get it from Let’s Encrypt? I need all necessary files to load certificate data by my own, and browsers are satisfied to tell users they have a secured connection.
You can't create a public trusted certificate via Letsencrypt with a domain name. There are some - rare - websites with ip-certificates (like https://1.1.1.1/ ), but this is something for the future.
So your server needs a public domain name and a connect like
You need a client to get a certificate. And you need a working challenge. If you don't have a webserver, you can use dns-validation. But then it's good if your dns provider has a supported API.
Confused.
I have asked Strato for certificate but they cannot / are not willing to give me. They say this is a certificate used for all websites of Strato.
I cannot use the same domain name for different IPs to access, was my oppinion, in this special case the IPs of Strato and mine are totally different.
But maybe I’m not well informed.
If you create your own webclient, normally you need a server with root access. So you don't use a certificate from Strato. Instead, install your own client and create an own Letsencrypt certificate.
Probably @JuergenAuer has already explained this completely, but I’ll try to summarize again:
Your certificate needs to be for a public DNS domain name
It needs to be a name that you control, or that is pointed at a server that you control
You create the certificate yourself, by running a Let’s Encrypt client application (normally on the web server itself)
After doing this, you’ll have all of the associated files; you also need to renew (that is, re-request) the certificate regularly because it’s only valid for 90 days
For example, if you had ws.example.com pointed at your server, you could install a Let’s Encrypt client application on that server and then use that application to request a Let’s Encrypt certificate covering ws.example.com. Let’s Encrypt would connect to the server to confirm that you control it, and then issue the certificate, which the client application would save on disk.
I would note that I don’t see www.tap-con-ws.de pointing to any IP address at all. Are you sure that this is publicly visible and not just something that you set up locally in a hosts file on your computer or something?
I would note that I don’t see www.tap-con-ws.de pointing to any IP address at all. Are you sure that this is publicly visible and not just something that you set up locally in a hosts file on your computer or something?
You are correct. Currently there is no url existing with this name. There is only an IP for my server.
I don’t think the terminology you used here (“url” and “IP”) has the exact meaning that you intended.
But in any case, you can’t ever get a certificate from Let’s Encrypt for a domain if that domain hasn’t been registered yet. And tap-con-ws.de hasn’t been registered yet, so you can’t prove to Let’s Encrypt that you control it, so Let’s Encrypt can’t issue a certificate for it.