# Unable to force standalone plugin to use a spefic port

**URL:** <https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866>\
**Category:** Help\
**Created:** [August 29, 2018, 12:13pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866 "2018-08-29T12:13:28Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![realtebo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/realtebo/32/25609_2.png) [@realtebo](https://community.letsencrypt.org/u/realtebo)\
**Post date:** [August 29, 2018, 12:13pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/1 "2018-08-29T12:13:28Z")

</div>

## TLD;DR

I ask certbot to challenge using standalone plugin and using http on port 10000; the standalone server is listening to port 1000, but acme challenge is done against port 80.

## The command I am running

```auto
sudo certbot certonly --standalone --non-interactive --preferred-challenge http-01 
   --http-01-port 10000 --agree-tos 
   --email realtebo@example.com --domains realtebo.example.com 
   --pre-hook 'sudo service webmin stop' 
   --post-hook 'sudo service webmin start' 
   --staging --dry-run

```

## The error

```auto
 Domain: realtebo.example.com
 Type: connection
 Detail: Fetching
 http://realtebo.example.com/.well-known/acme-challenge/DbE18Iyfud0xBRtrfvz-ILifSzqV-7GoV5uRAyuNYRw:
 Timeout during connect (likely firewall problem)

```

## Note about firewall

_I am sure I have no firewall problem_, Webmin is running on port 10000 and is reachable from outside

## Seems it’s using the port 80

See the following portion of the log

```
  "validationRecord": [
    {
      "url": "http://realtebo.example.com/.well-known/acme-challenge/nJANiwx4dXcJ5lnw-fVjdHyv7ZWop9GYf20pM7zl2ow",
      "hostname": "realtebo.example.com",
      "port": "80",
      "addressesResolved": [
        "redacted"
      ],
      "addressUsed": "redacted"
    }
  ]

```

I removed Ip but was correct.

**It’s using port 80 ! Why?**

## standalone server is correctly using the port I specified

Note this portion of log (_it is a port of the same run_)

```
2018-08-29 13:56:28,854:INFO:certbot.auth_handler:Performing the following challenges:
2018-08-29 13:56:28,854:INFO:certbot.auth_handler:http-01 challenge for realtebo.example.com
2018-08-29 13:56:28,855:DEBUG:acme.standalone:Successfully bound to :10000 using IPv6
2018-08-29 13:56:28,855:DEBUG:acme.standalone:Certbot wasn't able to bind to :10000 using IPv4, this is often expected due to the dual stack nature of IPv6 socket implementations.
....

2018-08-29 13:56:42,465:DEBUG:certbot.plugins.standalone:Stopping server at :::10000...
```

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [August 29, 2018, 1:09pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/2 "2018-08-29T13:09:14Z")

</div>

Hi @realtebo

> [@realtebo](#):
>
> http-01

> [@realtebo](#):
>
> It’s using port 80 ! Why?

the ACME-protocol (and Letsencrypt) accepts only port 80 as start of the http-01 - validation.

Port 80 is one of the "official ports". So if someone want's to show that he has the right to manage the domain, port 80 is a good choice.

So you have to open port 80.

If I know it correct: `http-01-port` is only used if there is a second server in front of this machine (proxy or firewall). So that certbot connects port 80 of the proxy / firewall.

---

<div class="post-metadata">

**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\
**Post date:** [August 29, 2018, 2:56pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/3 "2018-08-29T14:56:27Z")

</div>

> [@JuergenAuer](#):
>
> If I know it correct: `http-01-port` is only used if there is a second server in front of this machine (proxy or firewall). So that certbot connects port 80 of the proxy / firewall.

@JuergenAuer I think it might be to allow Certbot to bind the standalone HTTP-01 challenge server to a non-standard port such that another HTTP server already listening on :80 can be configured to redirect the challenge requests to the standalone server. Like you explained (thanks!) it won't help @realtebo because the initial challenge request will always be directed to port 80 by design.

---

<div class="post-metadata">

**Author:** ![realtebo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/realtebo/32/25609_2.png) [@realtebo](https://community.letsencrypt.org/u/realtebo)\
**Post date:** [August 29, 2018, 5:19pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/4 "2018-08-29T17:19:42Z")

</div>

I can’t stop the other webserver that is occupying the port 80. I did manual DNS challenge and resolved

Port 80 is often overrequested. And sometime we came into a situation where absolutely cannot have it.

The problem of this in my situation is that I cannot automate this. I cannot keep a redirect live only for a thing to do once every two or three months. I think I am not the only having more than one webserver in the lan but not having a proxy or similar.

What if simply I cannot change company firewall rules and my service is on a different port and it’s exposed only on this port? This is not an uncommon choice.

DNS challenge cannot be automatically done because two run asks for different codes as txt record.

In this machine I have 3 different services. No one use the port 80. This because a different machine run a we on port 80 exposed. And we cannot stop it only for a renewal. And also if I can, I cannot automate stop of service from this machine to the other.

The big problem is not in production, but while developing a strategy for deploying and auto scaling, No, we do not reuse certificates and neither server names. We do not use wildcards because haproxy config will be absurdly complicated in handling them. No. This haproxy cannot listen port 80 and redirect to other machine so we can do a challenge every totally.

Doing complicated things like this is my work. Situation I inherited or I am forced to accept or implement.

This is only for sale of discussion. Not a request and not a polemic.

Anyqay, I kindly suggest to explain better the goal of this option.  
And if one day could we have an option for change acme request port it should be great

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [August 29, 2018, 5:26pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/5 "2018-08-29T17:26:16Z")

</div>

The authorized ports are an industry standard. See section 3.2.2.4.6 of [https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.5.9.pdf](https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.5.9.pdf) and the definition of Authorized Port in 1.6.1.

> [@realtebo](#):
>
> What if simply I cannot change company firewall rules and my service is on a different port and it’s exposed only on this port? This is not an uncommon choice.
> 
> DNS challenge cannot be automatically done because two run asks for different codes as txt record.

That's what DNS provider APIs are meant for. Certbot currently has support for several of them (although it depends on how you install Certbot), and other clients have support for others. You can allow Certbot to create the requested TXT records automatically, which will allow for automated renewal. If your DNS provider isn't supported, you can use a CNAME record to refer the TXT lookup to a different zone on a different provider with a supported API (the CA's TXT record lookup process will follow CNAME referrals), or use a different Let's Encrypt client with different DNS provider API support.

One thing that we ought to do is more strongly discourage people from using `--manual` and mention that they should be using a DNS provider API instead.

> [@realtebo](#):
>
> Anyqay, I kindly suggest to explain better the goal of this option.

That would be a useful idea; do you have a suggestion of where we should do so? Did you look at the Certbot documentation on the web or the `--help` text for this option?

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [August 29, 2018, 5:30pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/6 "2018-08-29T17:30:36Z")

</div>

> [@schoen](#):
>
> One thing that we ought to do is more strongly discourage people from using `--manual` and mention that they should be using a DNS provider API instead.

It probably should emphasize automatic renewal (including the cronjob) is only possible when the manual plugin is used with scripts to facilitate the token adding and removal. Albeit it isn't that manual anymore at that moment 😬

---

<div class="post-metadata">

**Author:** ![realtebo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/realtebo/32/25609_2.png) [@realtebo](https://community.letsencrypt.org/u/realtebo)\
**Post date:** [August 29, 2018, 5:33pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/7 "2018-08-29T17:33:57Z")

</div>

Thanks for the PDF. I didn’t know it was a fixed requirement for CA certifications .

Thanks for this tool. There are of course a lot of different way to exit from situations like mine.

I was sure it was not a bug but I didn’t understand why it behaves in this way

So. I am fully satisfied.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 28, 2018, 5:36pm UTC](https://community.letsencrypt.org/t/unable-to-force-standalone-plugin-to-use-a-spefic-port/70866/8 "2018-09-28T17:36:47Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.