0

I have the following setup:

A Domain example.com

2 Servers: server1.example.com and server2.example.com

I would like to use srv records to have expressive domain names for each of my services. For example ssh.server1.example.com and imap.server2.example.com, and map these to specific ports using the srv records.

Now as I have understood letsencrypt needs to run on port 80 to verify a domain. If I now have ssh.server1.example.com mapped to server1.example.com and port 2222, would it be possible to get a certificate from letsencrypt? Will they just use the IP in the srv record and still look at port 80, or do I absolutely need an A record. I would not like to do that, neither would I map *.example.com somewhere.

Thanks in advance!

1 Answer 1

2

You can host your services however you want with the cert you obtain from LetsEncrypt. But in order to get a cert, you first need to prove that you own the domain name the certs are being generated for. With many Certificate Authorities, this is a fairly manual process. But part of the point of LetsEncrypt is automation of the whole certificate lifecycle which includes the domain validation.

So LetsEncrypt developed a protocol called ACME which uses a set of challenges that you must pass at least one of to prove you own the domain. The most common challenge that people use is the http challenge that requires you to host a particular file on a web server listening on port 80 for the domain you're requesting the cert for. But there is another challenge type utilizing DNS that doesn't require you to host anything. Instead, you add a particular DNS record to the zone you're requesting the cert for. Here's a google doc someone put together comparing the various challenge types.

So in your case, using the DNS challenge probably makes the most sense. But you should read up in the documentation to learn more about how that works.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .