Install certbot when intentionally port translating

Help
1

My web server is intentionally behind a firewall that’s port translating external port 11443 to internal port 443. How do I get certbot to work through that?

My domain is: xymon.watersprings.net

I ran this command: sudo certbot --apache

It produced this output: Timeout during connect (likely firewall problem)

My web server is (include version): Apache/2.4.18

The operating system my web server runs on is (include version): Ubuntu 16.04.6

My hosting provider, if applicable, is: self hosted VM

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.31.0

2

So you mean external people (like me or anyone else on the internet) would have to type in https://xymon.watersprings.net:11443 to get to your site?

Or do you mean it the other way around? That your Apache is listening on port 11443 and that your firewall translates my request on port 443 to the port 11443 on Apache?

3

Yes, I mean external people (anyone on the internet) would have to type in https://xymon.watersprings.net:11443 to get to the site. Currently if you just enter xymon.watersprings.net:11443 it will display as http, but not https

4

Quoting from the docs here: Challenge Types - Let's Encrypt

The HTTP-01 challenge can only be done on port 80. Allowing clients to specify arbitrary ports would make the challenge less secure, and so it is not allowed by the ACME standard.

If you cannot open Port 80, then you could try switching to the DNS-01 challenge type.

2 Likes
5

In addition to @ezekiel’s post: this isn’t a limitation of Let’s Encrypt, but is mandated by the CA/B Forum, the consortium which regulates the SSL/TLS certificate guidelines.

1 Like
6

So, if I go ahead and open 443 through the firewall, the cert will install and work? If I close it again will the cert update later?

7

Port 443 doesn’t actually matter. Certbot is using HTTP-01 validation, which uses and requires port 80.

(Let’s Encrypt supports TLS-ALPN-01 validation, which does use port 443, but Certbot has not implemented it yet.)

2 Likes
8

Ok, so I opened both ports 80 and 443 and was successful in installing the cert. Then I closed both ports again. Now the port 11443 translation works as expected.

My question now is will the cert auto-renew next month? Or will I need to open port 80 in order for it to auto-renew?

1 Like
9

Port 80 will need to be open for the duration of each HTTP-01 Challenge validation attempt. So, if you do not want Port 80 to simply remain open, then you’ll have to open the port each time.

2 Likes
10

In addition to @ezekiel’s post (:grin:): see also the following article from the Let’s Encrypt documentation: Best Practice - Keep Port 80 Open.

2 Likes
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.