Hello, We are planning on using boulder to run our own CA server. I have successfully followed your guide on: https://github.com/letsencrypt/boulder/blob/master/README.md to start my boulder server on localhost. However, now I want to deploy a production server (to be used without localhost). I a…

Agreed… But why am I getting the text/html error?

Hey, You need to point Certbot at your directory, not at the home page of Boulder :slight_smile: . For example, certbot register --server https://boulder.ctao6.net/directory --register-unsafely-without-email Now, your other problem, as already pointed out, is that the absolute URLs generated by …

[image] _az: Host: boulder.ctao6.net X-Forwarded-Proto: https Thanks! That gets me to the next stage. Now it claiming that my domain is not registered... (I removed the real domain name fro the printout because I'm not sure I want it on a public forum) I can include it if it is important…

So I think that the Docker environment for Boulder does not provide real DNS resolvers, and instead points to something called challtestsrv (which does not do real DNS). In production, Let’s Encrypt runs https://www.unbound.net/ for its resolvers. I think you need to setup some resolvers and then…

If I had access to the dockerfile I could try to reverse engineer and debug it. However the docker-compose.yml only downloads a binary docker image: letsencrypt/boulder-tools-go${TRAVIS_GO_VERSION:-1.10.2}:2018-06-12 Any idea where I can see the dockerfile for that? The answer to my dns problems…

[image] Simple Boulder server setup The FAKE_DNS value is a little confusing / misleading. It’s not the address used for DNS lookups, it’s the address returned from DNS lookups. We have a fake DNS server ( dns-test-srv ) bundled with Boulder that always returns the same result for A lookups. It r…

I can confirm what @_az says is correct. You’ll need to change the dnsResolvers settings to point at a DNS server that can resolve the hostnames you want to issue for. If those hostnames are only resolvable from inside your internal network, you’ll need to point at your internal nameserver. Also, j…

[image] jsha: certificates from your own Boulder instance will not be trusted by most browsers Sure, this is not meant for web browsing. This is meant for some custom software. [image] jsha: You’ll need to change the dnsResolvers I tried doing this in both files (changing my DNS to mu…

OK, Found the problem! I needed to manually specify port 53. “8.8.8.8” was not verbose enough. I needed to specify 8.8.8.8:53 explicitly.

Be cautious about using public resolvers. They will cache answers (such as for _acme-challenge.example.org), which will cause Boulder to incorrectly fail your authorizations, depending on timing.

Deploying Boulder in Production

Server

Patches July 12, 2018, 2:58pm 20

Topic		Replies	Views
Simple Boulder server setup Server	12	6366	March 9, 2018
Boulder -Initial Version of Boulder Deplyment in Production Help	13	1475	September 16, 2021
Urn:acme:error:connection :: The server could not connect to the client to verify the domain Help	14	6441	July 2, 2019
Deploying Boulder in my machine Help	11	2106	July 3, 2020
Boulder doesn’t resolve the actual client IP; instead, it uses the FAKE_DNS-assigned IP Help	9	353	July 7, 2025

Deploying Boulder in Production

Related topics