Using NAT and changing the port

[spqrforever]

When using NAT to my server, from which IP addresses is the connection coming from? Is it possible to change the port of certbot from 80 to another? I just don't want to open port 80 for everyone. Do I understand correctly that I should then use WEBROOT ?

[Osiris]

@spqrforever

When using NAT to my server, from which IP addresses is the connection coming from?

Still the Let's Encrypt IP address(es). NAT (usually) changes the destination IP address from the public IP address to the local private IP address. But it keeps the source address the same.

@spqrforever

Is it possible to change the port of certbot from 80 to another?

Yes, that's possible. But note that the Let's Encrypt validation server will always connect to port 80. However, if you use NAT to, for example, portmap external port 80 to internal port 8080, you could run Certbot on port 8080.

@spqrforever

I just don't want to open port 80 for everyone.

There is no reason to close port 80 and keep port 443 (for HTTPS) open. Any attack vector on port 80 would also work on port 443.

@spqrforever

Do I understand correctly that I should then use WEBROOT ?

Multiple authenticator plugins are capable of the http-01 challenge, not only the webroot plugin.

[spqrforever]

@Osiris

There is no reason to close port 80 and keep port 443 (for HTTPS) open. Any attack vector on port 80 would also work on port 443.

My Web applications only work within the local network and through VPN, so I don't want to do NAT.

@Osiris

Yes, that's possible. But note that the Let's Encrypt validation server will always connect to port 80. However, if you use NAT to, for example, portmap external port 80 to internal port 8080, you could run Certbot on port 8080.

Do I understand correctly that I need to stop the Nginx service each time to renew the certificates?

@Osiris

Still the Let's Encrypt IP address(es). NAT (usually) changes the destination IP address from the public IP address to the local private IP address. But it keeps the source address the same.

I would like to know the list of IP addresses so that I can only NAT those addresses.

[Osiris]

@spqrforever

Do I understand correctly that I need to stop the Nginx service each time to renew the certificates?

No, that's not necessary. Certbot can also use a existing webserver, such as nginx. (By using the nginx plugin or the webroot plugin.) But you asked specifically if Certbot could listen on a different port than 80, so the answer would be "yes" to that specific question.

@spqrforever

I would like to know the list of IP addresses so that I can only NAT those addresses.

No such list is available and no such list will be available. See also: FAQ - Let's Encrypt

[spqrforever]

@Osiris

No, that's not necessary. Certbot can also use a existing webserver, such as nginx. (By using the plugin or the plugin.) But you asked specifically if Certbot could listen on a different port than 80, so the answer would be "yes" to that specific question. nginx webroot

Tell me how you can update certificates without stopping Nginx.

[Osiris]

See the Certbot website: https://certbot.eff.org/

[petercooperjr]

@spqrforever

My Web applications only work within the local network and through VPN, so I don't want to do NAT.

If these are "private" servers, you may find using the DNS-01 challenge more suitable, as then only the DNS server needs to be exposed to the world rather than also exposing the web server. The only tricky part that that you need to automate the proper response to the DNS challenge, either through using a DNS server that supports an API (and a plugin for your ACME client to use it), or through something like acme-dns or agnos.

[rg305]

@spqrforever

Tell me how you can update certificates without stopping Nginx.

Several ways:

• NAT external IP port 80 to internal IP port ##### [some unused port]
  run certbot in --standalone mode and have it listen on port #####
  [zero conflict with any existing web service(s) (running on any other ports)]
• Use --webroot
  Presuming your nginx has an HTTP listener that can respond to http://external-IP:80/
• Use DNS-01 authentication
  This "works" without using an HTTP service.
  [more complicated than HTTP authentication and not all DSPs support the required DNS updates via API]