# SSL Letsencrypt behind NAT and on different port than 443 **URL:** \ **Category:** Help\ **Created:** [February 21, 2017, 7:26pm UTC](https://community.letsencrypt.org/t/ssl-letsencrypt-behind-nat-and-on-different-port-than-443/28384 "2017-02-21T19:26:44Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![packal](https://avatars.discourse-cdn.com/v4/letter/p/ee59a6/32.png) [@packal](https://community.letsencrypt.org/u/packal)\ **Post date:** [February 21, 2017, 7:26pm UTC](https://community.letsencrypt.org/t/ssl-letsencrypt-behind-nat-and-on-different-port-than-443/28384/1 "2017-02-21T19:26:44Z")
Hello I have web server behind NAT, this server has only https (no http). I have only one port - 444, which is visible from internet (on router is set port forwarding from 444 external to 443 internal), DNS is set, that A record is public IP address of router. Then I need letsencrypt certificate, but validation does not work (fail to connection) I try: letsencrypt certonly -a manual -d [dicomweb.multiscan.cz](http://dicomweb.multiscan.cz) --http-01-port 444 --test-cert Outout is: Saving debug log to /var/log/letsencrypt/letsencrypt.log │ │ Starting new HTTPS connection (1): [acme-staging.api.letsencrypt.org](http://acme-staging.api.letsencrypt.org) │ │ Obtaining a new certificate │ │ Performing the following challenges: │ │ http-01 challenge for [dicomweb.multiscan.cz](http://dicomweb.multiscan.cz) │ │ Using non-standard port for http-01 verification: 444 │ │ Starting new HTTP connection (1): [dicomweb.multiscan.cz](http://dicomweb.multiscan.cz) Output is: Failed authorization procedure. [dicomweb.multiscan.cz](http://dicomweb.multiscan.cz) (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Could not connect to [dicomweb.multiscan.cz](http://dicomweb.multiscan.cz) IMPORTANT NOTES: - The following errors were reported by the server: My domain is: [https://dicomweb.multiscan.cz:444/](https://dicomweb.multiscan.cz:444/) My operating system is (include version): Debian 8 My web server is (include version): Apache 2.4 ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [February 21, 2017, 7:32pm UTC](https://community.letsencrypt.org/t/ssl-letsencrypt-behind-nat-and-on-different-port-than-443/28384/2 "2017-02-21T19:32:46Z")
> [@packal](#): > > My domain is: [https://dicomweb.multiscan.cz:444/](https://dicomweb.multiscan.cz:444/) No, that isn't your domain, that's your URL, which is something completely different. Let's Encrypt needs to confirm that you own and control each hostname for which you're seeking a certificate. It supports three ways of doing that: - The HTTP-01 challenge requires that the public Internet be able to connect to http://:80$HOSTNAME, for each $HOSTNAME you request a cert for. The --http-01-port flag will let certbot listen on a different port, in case you have port forwarding, a reverse proxy, or some other such thing going on, but the Let's Encrypt servers must still be able to connect via port 80. - The TLS-SNI challenge requires that the public Internet be able to connect to port 443 on $HOSTNAME. As above, you can specify that certbot listen on a different port, but the Let's Encrypt servers will connect to port 443. - The DNS-01 challenge requires that you be able to add TXT DNS records for each requested hostname, ideally through an API or some automated mechanism. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 23, 2017, 7:33pm UTC](https://community.letsencrypt.org/t/ssl-letsencrypt-behind-nat-and-on-different-port-than-443/28384/3 "2017-03-23T19:33:06Z")
Closed on March 23, 2017, 7:33pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.