IPv6 SSL certificate for ports other than 80/443

Help
1

Dear let's encrypt community,

I have a couple of IPv6 apache webservers running, where I got a let's encrypt ssl certificate via Certbot locally installed on the webservers. Now, this all works over port 80/443. Now, the question is how do I get an SSL certificate for a port other than 80/443 for IPv6 ? With IPv4 you can just use Nginx proxymanager for instance and then get a let's encrypt SSL for all your applications that run on any port. However, with IPv6 I do not seem to understand to get an SSl certificate for an application with the domain name https://[ipv6address]:8096 for instance. Hopefully, one of you guys can help me how SSL certificates work for non 80/443 ports.

Cheers,

Dennis

2

Hi @encrypt, and welcome to the LE community forum :slight_smile:

I think we need to clear up some things that you might be confused about.

  1. LE doesn't provide certificates for IP addresses.
    [not for IPv4 addresses - not for IPv6 addresses (at least not yet)]

  2. TLS/SSL certificates are not bound to any specific port.
    [they can be used by any service on any unused port]

So...
You won't be able to get a cert [from LE] for:

You can use an existing cert as:
https://[name-on-cert]:8096

To that end, let's see what names are available to you for such use, with the outputs of:
certbot certificates
sudo apachectl -t -D DUMP_VHOSTS

4 Likes
3

Thank you for your fast reply @rg305. Now, I just don't know how to get a certificate for applications that I run in docker e.g jellyfin runs on port 8096 for instance. If I go into my jellyfin virtual machine, install certbot I do the following:

sudo certbot certonly --standalone
Fill in domain name: ipv6address.com:8096

Then I get this error message: 'The server will not issue certificates for the identifier :: Error finalizing order ::'. So I figured that you cannot apply for a certificate with a port other than 80

Also, I know that my Jellyfin application is reacheable over IPv6. When I type http://[ipv6address]:8096 I got to my Jellyfin application perfectly, but insecurely without a certificate.

Thank you for your help already!!

1 Like
4

The --standalone authentication will try port 80.
What is answering that IPv6 address on port 80?

And...

4 Likes
5

certbot certificates
`sudo apachectl -t -D DUMP_VHOSTS

When I try this I only get certificates for ipv6 websites on port 80. I don't know how to get the nginx proxymanager let's encrypt IPv4 equivalent for IPv6 addresses. Because with IPv6 I don't even need a proxy, I can just call the application directly, and I can but only over an insecure connection.

6

I guess, the question would be, how do I get an SSL certificate for an IPv6 service that does not run on Apache.

7

The same ways you get any other LE certificate via ACME protocol:

  • HTTP-01 validation
  • HTTPS-ALPN-01 validation
  • DNS-01 validation

If you already have a certificate, you may be able to use that cert on your IPv6 address with any unused port.
[i.e. You may NOT need to get another cert just for this use]

4 Likes
8

thank you @rg305. I have never done this before, since I always used nginx proxymanager for IPv4. I will search on the internet on how to set something up like this.

1 Like
9

It seems you already have a cert [or more] that can be [re]used on whatever port you desire.

The main problem in this equation is:

It is a very bad piece of... software.

4 Likes
10

yes, I just need to figure out how to place the certificate inside the docker file :wink:

11

If you already have a certificate for that specific hostname somewhere, can't you simply make some kind of volume in the Docker container where you want to use that certificate?

5 Likes
12

yess that's a good idea! however I just don't know the exactly where I should mount it to inside the docker container. I did see videos online where they do it inside an NGINX container.

13

I'm not proficient with Docker in any way, so I can't help you with the details. And Docker configuraton per se is probably outside of the scope of this Community.

2 Likes
14

Just to be really clear about this conceptually (although I think you've probably got it!), there is a difference here between

  • how do you get the certificate (including in the future for eventual renewals)? (you have to prove control of the domain name using port 80, port 443, or DNS TXT records—by Let's Encrypt policy)
  • how do you use the resulting certificate with a service on a port other than 443? (a matter of configuration for the application that provides that particular service, and in this case maybe also a container that it runs inside of)
6 Likes
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.