Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Summary:
-> Getting certs for all three of the below domains works fine individually, but if we try to specify SANS entries it does ok with the local, but throws error for the other two domains. If we try from the servers hosting autha or authb it fails for the other two domains.
the three domains have three different ip-addresses. So if you run the command on the webserver of gateway.tfs.amerstage.dxcidam.com - can this certbot really copy files to the /.well-known/acme-challenge/ - subdomains of the other two domains?
Thank you so much for the quick reply. That is a great question, and I am not sure. All I know is I see the requests reach the other two servers from their access logs. It usually shows four requests from different IPs come in from let’s encrypt:
Also, if I put a test page in the acme-challenge folder of any of these servers I can reach them from the server issuing the certbot command, or from a browser with no issues.
That was it. Thank you so much JuergenAuer… I am new to let’s encrypt / certbot and wasn’t thinking that certbot generates the file in acme-challenge locally that let’s encrypt then reaches in to get for verification - so of course it wouldn’t be able to create on the other servers. Temporarily pointing the other dns records to the same server allowed me to get the cert with all the subject alternative names.
A problem with this is that you'll have to repeat this at every subsequent renewal time. If you can't do that, maybe you could make the web servers on the other machines redirect http://b.example.com/.well-known/acme-challenge to http://a.example.com/.well-known/acme-challenge with an HTTP 301 redirect, where a.example.com is the machine where you're running Certbot. (Or else run Certbot separately on each machine, as @JuergenAuer suggested.)
That is a great suggestion. What I did today is definitely untenable it was just a workaround to see if the SANS resolved another issue of mine. I will try to implement what you suggested.