Certificates for Backup Servers

Has anything improved with Certbot to make it any easier to handle backup servers yet?

I have 4 servers (2 main, 2 set up for failover backup), plus 2 other servers.

phineas.my-domain.com (my-domain.com main)
ferb.my-domain.com (my-domain.com backup)
perry.my-domain.com (eu.my-domain.com main)
doofenshmirtz.my-domain.com (eu.my-domain.com backup)
candace.my-domain.com (utility server with a few other domains)
carl.my-domain.com (email server)

I can get Certbot to work fine on the main servers, but not the backup servers because the domains don’t point to the backup servers unless there is a failover on the main servers (automatic through DNS Made Easy).

Last time I asked about this, I was told the only way was to copy the certificates over from the main to the backup servers every 90 days. So either I have to manually do this every 90 days, or set up rsync and a cron job to do this (plus some file management because I don’t want rsync to have direct access to root folders).

Are there any other easier options now?

I wish there was something I could do to let Certbot know these are backup servers so I don’t have to jump through these extra hoops to try and get this to work on the backup servers, and just let Certbot take care of things.

Thank you.

I don’t think the Certbot project is ever going to prioritize this kind of setup, really. I don’t think anything has changed at all to make this easier.

What webserver do you use? If it’s something with a flexible configuration language like nginx, you can just configure all of your servers to respond to challenges statelessly (like this) and share the ACME account private key between your main and backup servers (a one-time action).

No more authenticator required, no coordination or file synchronization required. Every server will be able to issue and renew certificates regardless of whether it is actively serving traffic for the domain or not.

1 Like

You could use DNS validation – Certbot has a DNS Made Easy plugin, though it may or may not be easy to install on your OS.

2 Likes

Thank you, I might be able to get that to work. I didn’t know about that.