I have an old Debian Wheezy system, for which I need a certificate for Postfix and Courier (imap). There is an Apache webserver running, and only port 443 (not 80) is open in the firewall. I’ve tried using both certbot-auto and getssl, but they both seem to advertise a ‘http:’//’ url to validate, w…

I’m sitting here with kinda the same problem. I got my regular websites und my-domain.au , shop.my-domain.au , admin.my-domain.eu and they all sit in the same webroot. For those i have no problem when i try to get certificates for those domains. I have another subdomain mail.my-domain.au and the web…

The only way to force the webroot plugin to use https is to configure your server to respond to the http request with a redirect (which means you still need port 80 open). If you want to use port 443 only, you can use the apache, nginx (I think) or standalone plugins instead of webroot. You might n…

As Apache is already listening on port 443, I think only the Apache plugin would apply, but unfortunately that one does seem to need a more recent version of augeas than is available in Debian Wheezy. Also, I don’t really want automatic updates in my Apache configuration, which relies a lot on macr…

Are there other clients besides certbot or getssl I should look at, that may solve my problem?

[image] bartjan: Are there other clients besides certbot or getssl I should look at, that may solve my problem? No. Your problem is that whatever client you use must do one of three things to validate control over your hostname: It must respond appropriately to a request for http://$HOSTNA…

Is it possible to request https auth to an alternate port (not 443)? Assuming there is another port allowed through the firewall.

[image] rg305: Is it possible to request https auth to an alternate port (not 443)? Assuming there is another port allowed through the firewall. Nope, this is forbidden by the ACME specification and partially forbidden (well, significantly restricted) by CA/Browser Forum rules.

Of the 3 options, using tls-sni may have been an option for me, by running certbot in standalone mode, on an alternative port, and then redirect traffic originating from letsencrypt to that port, but then I would have to guess what IP address letsencrypt is using. Instead, I decided to adjust my Ap…

How to get a certificate, without using port 80?

Help

schoen June 16, 2017, 12:52am 8

Nope, this is forbidden by the ACME specification and partially forbidden (well, significantly restricted) by CA/Browser Forum rules.

Topic		Replies	Views
Which port to use for the webroot plugin? Help	2	1719	July 15, 2019
How to force certbot to use HTTP for authentication instead of HTTPS? Help	3	7886	February 24, 2018
Webroot and https-only server impossible Help	20	28831	May 25, 2017
Obtain cert with nginx with self signed on port 443 using webroot Server	6	4452	October 21, 2016
Installation correctly happened but https not working Help	2	1534	March 9, 2017

How to get a certificate, without using port 80?

Related topics