Certificates for backup servers using proxy pass

Server
1

Hi friends,
I've two VPS, and I would like to know if should be possible to use as "controller machine" (as described here ) one of this my two server or if is necessary a third server.

Many thanks!

2

Hi @dandje, it should be fine for one of the machines to be one of your web servers. It doesn’t need to be a separate machine.

2 Likes
3

OK, I proceed then will follow a short report of mine to help other users.

thanks!

4

Hi danjde,

I “think” you are asking, can the controller machine be an email server too. The answer is YES! Your solution sounds fine.

danday74

5

Hi danday74 and thanks for your kind reply,
excuse me for my bad English, the question is:

to use one of the two email servers, as “controller machine” to get the certificates for both of themselves.

Thanks again!

6

yes thats fine as follows:

machine 1 - is controller machine and email server and is the machine on which to execute the lets encrypt CLI commands
machine 2 - this is an email server only and it should proxy pass let’s encrypt requests to machine 1

1 Like
7

Very thanks for your help danday74!
I wanted to be safe before doing disasters! :smiley:

Thanks again :wink:

8

Hi friends,
I’ve make all changes as suggested by @danday74, but when I run certbot:

certbot certonly --webroot -w /var/www/letsencrypt --expand -d server.sio4.org -d sio4.org -d www.sio4.org -d pop.sio4.org -d mail.sio4.org -d smtp.sio4.org -d server2.sio4.org [..]

Obtain the error:

Failed authorization procedure. server2.sio4.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://server2.sio4.org/.well-known/acme-challenge/Kqy88NRyl3ZXui2JoBa1AMRmtSkL40WdfpwKWy-KYCE: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: server2.sio4.org
   Type:   unauthorized
   Detail: Invalid response from
   http://server2.sio4.org/.well-known/acme-challenge/Kqy88NRyl3ZXui2JoBa1AMRmtSkL40WdfpwKWy-KYCE:
   "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   <html><head>
   <title>404 Not Found</title>
   </head><body>
   <h1>Not Found</h1>
   <p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

To date I made these changes:

  1. DNS entry: on sio4.org DNS, add record as “A” value “ctrl” to “91.205.175.213” (server.sio4.org)

  2. DNS entry: on sio4.org DNS, add record as “A” value “server2” to (backup server) 5.189.166.16

  3. DNS entry: add MX backup (server2.sio4.org -> 5.189.166.16) value on every “my” DNS domain

  4. Add to every Virtual Domain Apache (only http and not non https):

     `ProxyPass "/.well-known/acme-challenge/" "http://ctrl.server.sio4.org:80"`

  5. Maintained the Apache Letsencrypt configuration:

    Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
    <Directory “/var/www/letsencrypt/.well-known/acme-challenge/”>
    Options None
    AllowOverride None
    ForceType text/plain

    avoid access to anything not resembling a challenge

    #RedirectMatch 404 “^(?!/.well-known/acme-challenge/[\w­]{43}$)”

  6. enabled on server.sio4.org Apache proxy module: a2enmod proxy

  7. Checked the Apache accuracy configuration: apachectl configtest

Should I delete the current Letsencrypt configuration/folder and run again certbot?

Any help is very appreciate, GASP! :slight_smile:

9

If you create /var/www/letsencrypt/test.txt, can you see it at http://server2.sio4.org/test.txt?

If you create /var/www/letsencrypt/.well-known/acme-challenge/test.txt, can you see it at http://server2.sio4.org/.well-known/acme-challenge/test.txt?

If not, your Apache configuration is still not correct yet.

10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.