# Certificates for backup servers using proxy pass

**URL:** <https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710>\
**Category:** Server\
**Created:** [May 9, 2017, 4:36pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710 "2017-05-09T16:36:56Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![danjde](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danjde/32/8575_2.png) [@danjde](https://community.letsencrypt.org/u/danjde)\
**Post date:** [May 9, 2017, 4:36pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/1 "2017-05-09T16:36:56Z")

</div>

Hi friends,  
I've two VPS, and I would like to know if should be possible to use as "controller machine" (as described [here](https://community.letsencrypt.org/t/will-lets-encrypt-work-for-me-multiple-servers-serving-one-domain/6830/16) ) one of this my two server or if is necessary a third server.

Many thanks!

> [@Will Let's Encrypt work for me? (Multiple servers serving one domain)](https://community.letsencrypt.org/t/will-lets-encrypt-work-for-me-multiple-servers-serving-one-domain/6830/18):
>
> i can confirm this works.
> 
> location ~ /.well-known/acme-challenge/ {  
> proxy\_pass [http://ctrl.mydomain.com:80](http://ctrl.mydomain.com:80);  
> }
> 
> using nginx i added this location to ALL server blocks.
> 
> You then run lets encrypt on the machine [ctrl.mydomain.com](http://ctrl.mydomain.com) (this machine typically is the controller machine, and is not serving web stuff - its pure purpose from a web POV is to handle incoming cert requests - if you don't know what a controller machine is then read up on ansible)
> 
> To make it work I had to use the webroot plugin for Let's Encrypt. I could not get standalone mode to work.
> 
> my A records look like ..
> 
> [www01.mydomain.com](http://www01.mydomain.com) points to 1.2.3.4  
> [www02.mydomain.com](http://www02.mydomain.com) points to 2.3.4.5  
> [ctrl.mydomain.com](http://ctrl.mydomain.com) points to 3.4.5.6  
> [mydomain.com](http://mydomain.com) points to 1,2,3,4 and 2,3,4,5 (multiple A records)  
> [www.mydomain.com](http://www.mydomain.com) is an alias (cname) for [mydomain.com](http://mydomain.com)
> 
> NGINX runs on www01 and www02 on port 80 to load balance requests (e.g. www01 load balances between www01 and www02, www02 ALSO load balances between www01 and www02)
> 
> the above lets encrypt location block is added to NGINX running on both www01 and www02 for all NGINX server blocks
> 
> now run lets encrypt in webroot mode (you will need to standup a web server on your controller machine) and request a single certificate for [www01.mydomain.com](http://www01.mydomain.com) [www02.mydomain.com](http://www02.mydomain.com) [mydomain.com](http://mydomain.com) [www.mydomain.com](http://www.mydomain.com)
> 
> when you run this command on your controller machine ([ctrl.mydomain.com](http://ctrl.mydomain.com)) it will fireoff a request to each of the 4 domains in return. Every single request will be proxied back to [ctrl.mydomain.com](http://ctrl.mydomain.com) via NGINX
> 
> bosh!  
> [..]

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 9, 2017, 8:19pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/2 "2017-05-09T20:19:22Z")

</div>

Hi @dandje, it should be fine for one of the machines to be one of your web servers. It doesn’t need to be a separate machine.

---

<div class="post-metadata">

**Author:** ![danjde](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danjde/32/8575_2.png) [@danjde](https://community.letsencrypt.org/u/danjde)\
**Post date:** [May 10, 2017, 3:55pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/3 "2017-05-10T15:55:44Z")

</div>

OK, I proceed then will follow a short report of mine to help other users.

thanks!

---

<div class="post-metadata">

**Author:** ![danday74](https://avatars.discourse-cdn.com/v4/letter/d/77aa72/32.png) [@danday74](https://community.letsencrypt.org/u/danday74)\
**Post date:** [May 11, 2017, 9:18am UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/4 "2017-05-11T09:18:41Z")

</div>

Hi danjde,

I “think” you are asking, can the controller machine be an email server too. The answer is YES! Your solution sounds fine.

danday74

---

<div class="post-metadata">

**Author:** ![danjde](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danjde/32/8575_2.png) [@danjde](https://community.letsencrypt.org/u/danjde)\
**Post date:** [May 11, 2017, 2:18pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/5 "2017-05-11T14:18:30Z")

</div>

Hi danday74 and thanks for your kind reply,  
excuse me for my bad English, the question is:

to use one of the two email servers, as “controller machine” to get the certificates for both of themselves.

Thanks again!

---

<div class="post-metadata">

**Author:** ![danday74](https://avatars.discourse-cdn.com/v4/letter/d/77aa72/32.png) [@danday74](https://community.letsencrypt.org/u/danday74)\
**Post date:** [May 11, 2017, 2:44pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/6 "2017-05-11T14:44:58Z")

</div>

yes thats fine as follows:

machine 1 - is controller machine and email server and is the machine on which to execute the lets encrypt CLI commands  
machine 2 - this is an email server only and it should proxy pass let’s encrypt requests to machine 1

---

<div class="post-metadata">

**Author:** ![danjde](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danjde/32/8575_2.png) [@danjde](https://community.letsencrypt.org/u/danjde)\
**Post date:** [May 11, 2017, 3:00pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/7 "2017-05-11T15:00:05Z")

</div>

Very thanks for your help danday74!  
I wanted to be safe before doing disasters! 😃

Thanks again 😉

---

<div class="post-metadata">

**Author:** ![danjde](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danjde/32/8575_2.png) [@danjde](https://community.letsencrypt.org/u/danjde)\
**Post date:** [May 24, 2017, 3:47pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/8 "2017-05-24T15:47:03Z")

</div>

Hi friends,  
I’ve make all changes as suggested by @danday74, but when I run certbot:

`certbot certonly --webroot -w /var/www/letsencrypt --expand -d server.sio4.org -d sio4.org -d www.sio4.org -d pop.sio4.org -d mail.sio4.org -d smtp.sio4.org -d server2.sio4.org [..]`

Obtain the error:

```
Failed authorization procedure. server2.sio4.org (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://server2.sio4.org/.well-known/acme-challenge/Kqy88NRyl3ZXui2JoBa1AMRmtSkL40WdfpwKWy-KYCE: "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p"

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: server2.sio4.org
   Type: unauthorized
   Detail: Invalid response from
   http://server2.sio4.org/.well-known/acme-challenge/Kqy88NRyl3ZXui2JoBa1AMRmtSkL40WdfpwKWy-KYCE:
   "<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   <html><head>
   <title>404 Not Found</title>
   </head><body>
   <h1>Not Found</h1>
   <p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

```

To date I made these changes:

1. **DNS entry:** _on [sio4.org](http://sio4.org) DNS,_ add record as “A” value “ctrl” to “91.205.175.213” ([server.sio4.org](http://server.sio4.org))

2. **DNS entry:** _on [sio4.org](http://sio4.org) DNS,_ add record as “A” value “server2” to (backup server) 5.189.166.16

3. **DNS entry:** add MX backup ([server2.sio4.org](http://server2.sio4.org) -\> 5.189.166.16) value on every “my” DNS domain

4. Add to every Virtual Domain Apache (only http and not non https):

5. Maintained the Apache Letsencrypt configuration:

6. enabled on [server.sio4.org](http://server.sio4.org) Apache proxy module: a2enmod proxy

7. Checked the Apache accuracy configuration: apachectl configtest

Should I delete the current Letsencrypt configuration/folder and run again certbot?

Any help is very appreciate, GASP! 🙂

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [May 24, 2017, 4:44pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/9 "2017-05-24T16:44:13Z")

</div>

If you create /var/www/letsencrypt/test.txt, can you see it at [http://server2.sio4.org/test.txt](http://server2.sio4.org/test.txt)?

If you create /var/www/letsencrypt/.well-known/acme-challenge/test.txt, can you see it at [http://server2.sio4.org/.well-known/acme-challenge/test.txt](http://server2.sio4.org/.well-known/acme-challenge/test.txt)?

If not, your Apache configuration is still not correct yet.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 23, 2017, 4:44pm UTC](https://community.letsencrypt.org/t/certificates-for-backup-servers-using-proxy-pass/33710/10 "2017-06-23T16:44:35Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.