I am installing Sonarqube on a Cent OS 7 EC2 instance and trying to secure the domain with a HTTPS protocol from certbot. The issue is the EC2 instance is in a private subnet and doesn't have internet access to fetch dependencies, I downloaded packages manually and did a localinstall for Java and Sonarqube.
I am exploring the same for certbot with nginx, but there are way too many packages/dependencies to be downloaded and installed manually.
Is there a package or a method to install certbot nginx and obtain a certificate on a server with no internet access to fetch packages?
You're now especially talking about the installation step of certbot on a host without internet access.. But I'm more curious about the next step (which is even more important probably) and how you were planning to manage that without internet access: how are you planning to let certbot make the HTTPS connection to the ACME server? And how are you planning to set up the challenge required to prove ownership of the domain? Both require internet.
There are also other ACME clients available without as much dependencies as certbot by the way (such as those listed under 'Bash' in the linked list).
Thank you for providing that information. I am exploring Let's Encrypt for the first time and was not aware that it requires an internet connection to connect with ACME server for trusting the domain and issuing a certificate.
I will look at those options in the link you have provided.
Yeah, if the server doesn't have Internet access, you're not going to be able to have it run any client to request a certificate from Let's Encrypt.
Options for you I see are
Find some way to get that system Internet access, enough for updating its packages and connecting to Let's Encrypt's server.
Have some other system use a DNS-01 challenge to get the certificate, and then have some process to copy it to your isolated server. I've done something similar for my own system, so if your DNS is in AWS Route 53 you may want to look at my Lambda function that can get a certificate, which should just take some "minimal configuration and tweaking" to throw something together that's similar that works for you.
You may also want to explore the fairly new AWS Certificate Manager for Nitro Enclaves which would let you get a certificate from AWS (instead of from Let's Encrypt) that integrates with your EC2 Nginx without you needing to handle private keys yourself. It's not something I've used myself, but seems like it may be targeted at your kind of use case.
@petercooperjr , all these options are amazing thoughts. I really appreciate suggesting these things. I will explore this individually and decide on what's best for my use case.
