# Failed to create Cert for intranet Server **URL:** \ **Category:** Server\ **Created:** [October 25, 2018, 12:09pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769 "2018-10-25T12:09:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![itzoo](https://avatars.discourse-cdn.com/v4/letter/i/7ba0ec/32.png) [@itzoo](https://community.letsencrypt.org/u/itzoo)\ **Post date:** [October 25, 2018, 12:09pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/1 "2018-10-25T12:09:51Z")
Hello there, i’m actually working on an intranet dokuwiki that shall not be access from the internet. Its running on Apache2 on a Debian 9 Stretch and python-certbot-apache to create the cert. By trying to get a cert I get the Report DNS problem: NXDOMAIN looking up A for [wiki.domain.de](http://wiki.domain.de) We have a public domain [domain.de](http://domain.de) and the [wiki.domain.de](http://wiki.domain.de) has a intranet DNS entry to resolve it in our network. I have read now, that it is still possible to get a cert for this server with something called http-01 challange, but I do not get the way how to bring it up. If someone got through this and can explain or provide me with a link to a guide to get this running I would be very happy. Best Regards Sven ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 25, 2018, 12:23pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/2 "2018-10-25T12:23:17Z")
The authentication for http-01 challenge would come from the Internet. If your server is not accessible form the Internet, then that method would not be possible [directly from that system]. You are left with choosing between using another system, that is accessible from the Internet, to obtain the cert on behalf of the wiki server or use DNS authentication. Note: DNS auth requires that your Internet DNS provider has a supported method for update [or you will have to do the DNS entries manually - not recommended]. If the system is NOT accessed from outside your internal network, why does it need a cert that is trusted on the Internet? You could easier use a cert from any internal trusted CA [and it could have a much longer lifetime]. ---
**Author:** ![itzoo](https://avatars.discourse-cdn.com/v4/letter/i/7ba0ec/32.png) [@itzoo](https://community.letsencrypt.org/u/itzoo)\ **Post date:** [October 25, 2018, 12:46pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/3 "2018-10-25T12:46:24Z")
Hi there, well, then we have to look to get our existing wildcard onto the system. We are planning in the future to switch to let’s encrypt complete and this wiki should have been the first to get it test and started. A self trusted CA isn’t what we had in mind for it. So we will look to get our existing wildcard CA onto the wiki for now and change it to let’s encrypt wildcard later. Thank you for your explanation. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 25, 2018, 12:48pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/4 "2018-10-25T12:48:47Z")
No problem. Be sure you account for the fact that LE certs only last 90 days. You will be faced with the same synchronization problem whether the cert is wildcard or not. ---
**Author:** ![itzoo](https://avatars.discourse-cdn.com/v4/letter/i/7ba0ec/32.png) [@itzoo](https://community.letsencrypt.org/u/itzoo)\ **Post date:** [October 25, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/5 "2018-10-25T14:23:19Z")
Yup, i keep that in mind. I already using it in private too. 🙂 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 25, 2018, 8:31pm UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/6 "2018-10-25T20:31:10Z")
> [@itzoo](#): > > If someone got through this and can explain or provide me with a link to a guide to get this running I would be very happy. Not a link to a guide, but if your domain name server has an API so you can automate adding and removing TXT records, you _can_ issue certificates for internal only IP addresses, as long as the _hostname_ of that host (i.e., the DNS server) is accessible from the world wide web. ---
**Author:** ![itzoo](https://avatars.discourse-cdn.com/v4/letter/i/7ba0ec/32.png) [@itzoo](https://community.letsencrypt.org/u/itzoo)\ **Post date:** [October 26, 2018, 6:50am UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/7 "2018-10-26T06:50:41Z")
> [@Osiris](#): > > Not a link to a guide, but if your domain name server has an API so you can automate adding and removing TXT records, you _can_ issue certificates for internal only IP addresses, as long as the _hostname_ of that host (i.e., the DNS server) is accessible from the world wide web. You mean for getting a Cert I let my DNS make and A record for the specific time to get the cert and invoke this entry later? Or did i got it wrong? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 26, 2018, 8:38am UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/8 "2018-10-26T08:38:14Z")
> [@itzoo](#): > > You mean for getting a Cert I let my DNS make and A record for the specific time to get the cert and invoke this entry later? Or did i got it wrong? A TXT record, not an A record. `certbot` has a few plugins for automated DNS challenge validation, but depending on your system distribution it is easy or not so easy to install them. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 25, 2018, 8:38am UTC](https://community.letsencrypt.org/t/failed-to-create-cert-for-intranet-server/75769/9 "2018-11-25T08:38:15Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.