# Standalone certificate without web server?
**URL:** https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651
**Category:** Help
**Created:** [April 16, 2018, 5:50pm UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651 "2018-04-16T17:50:01Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@karoshi](https://community.letsencrypt.org/u/karoshi)
#### Post date: [April 16, 2018, 5:50pm UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/1 "2018-04-16T17:50:01Z")
I’ve actually used letsencrypt quite a few times. But for this particular set up, I want to create a root/trusted CA for a postgres server to use to secure connections to its database, and I do NOT have apache nor nginx installed on this server, quite deliberately so. Is there a way to create standalone certificates without using this extra overhead? (Yes, postgres has a mechanism for using self signed certificates, but I’ve run into this:
[https://www.postgresql.org/message-id/20170418142919.24369.5931%40wrigleys.postgresql.org](https://www.postgresql.org/message-id/20170418142919.24369.5931%40wrigleys.postgresql.org)
and I’m trying to rule out that the issue is the self-signed CA by (quickly) getting a real CA.)
Even the examples of “standalone” circle around back to using some kind of web server.
The error when installing with the --standalone option is that the .well-known/acme-challenge file can’t
be accessed but OF COURSE it cannot when I don’t have the web server installed!
If this is impossible, then just let me know and I’ll use a more standard CA issuing authority. I was kind of hoping to resolve my issue quickly :-/
---
### Author:  [@fallingrock](https://community.letsencrypt.org/u/fallingrock)
#### Post date: [April 16, 2018, 6:07pm UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/2 "2018-04-16T18:07:16Z")
You could use the DNS verification method. That doesn’t require a web server.
---
### Author:  [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [April 16, 2018, 6:08pm UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/3 "2018-04-16T18:08:40Z")
> [@karoshi](#):
>
> The error when installing with the --standalone option is that the .well-known/acme-challenge file can’t be accessed
Certbot's --standalone option runs its own, built-in web server (momentarily). If port 80 is open to the Internet, it will work.
---
### Author:  [@schoen](https://community.letsencrypt.org/u/schoen)
#### Post date: [April 16, 2018, 6:19pm UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/4 "2018-04-16T18:19:24Z")
We can distinguish between “port 80 is blocked” and “port 80 is redirected to a different server or there’s an existing web server after all” if we can see the exact error message from Certbot.
---
### Author:  [@karoshi](https://community.letsencrypt.org/u/karoshi)
#### Post date: [April 17, 2018, 2:27am UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/5 "2018-04-17T02:27:28Z")
Thank you! This did the trick. I did not realize that it had its own temporary web server for this process, so opening a crack in the firewall did the trick.
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [May 17, 2018, 2:27am UTC](https://community.letsencrypt.org/t/standalone-certificate-without-web-server/59651/6 "2018-05-17T02:27:46Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.