I want to set up certbot for a webserver on a different port than 443. I got the following error when running

certbot --apache -d <sub>.<domain>.<ext>

Failed authorization procedure. sub.domain.ext (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to external_ip:443 for TLS-SNI-01 challenge

After this error I've read the man pages, where I found this:

--tls-sni-01-port TLS_SNI_01_PORT Port number to perform tls-sni-01 challenge. Boulder in testing mode defaults to 5001. (default: 443)

Then I tried the following to correct this error:

certbot --apache --tls-sni-01-port 14831 -d <sub>.<domain>.<ext>

After adding the tls-sni-01-port, I got the same error.

Is it possible to install a certificate with a different port, or am I doing something wrong?

  • Could you please provide us with the documentation for certbot that states how to use "--tls-sni-01-port 14831"? I have'nt seen it there, yet
    – Orphans
    Sep 27, 2016 at 17:35
  • --tls-sni-01-port TLS_SNI_01_PORT Port number to perform tls-sni-01 challenge. Boulder in testing mode defaults to 5001. (default: 443) Sep 27, 2016 at 17:36
  • Have you tried --dvsni-port {PORT}?
    – Orphans
    Sep 27, 2016 at 17:38
  • Read that, but if I try certbot --apache --dvsni-port <port> -d <sub>.<domain>.<ext> it says: certbot: error: unrecognized arguments: --dvsni-port <port> Sep 27, 2016 at 17:41
  • 2
    SSL could be on any port, you just need to specify the port number Sep 27, 2016 at 19:09

3 Answers 3


According to: https://community.letsencrypt.org/t/how-to-specify-a-port-different-from-443-for-the-dvsni-challenge/12753/4

This is not possible with certbot. You should take a look at the other implementation method here: https://community.letsencrypt.org/t/list-of-client-implementations/2103

  • 3
    Certbots FAQ seems to say otherwise? certbot.eff.org/faq/… Sep 26, 2017 at 1:58
  • 1
    @DouglasGaskell The FAQ has changed since this answer was posted. But that does not change the answer actually. There is no way to issue an LE certificate on another ports then 80 or 443 according to the FAQ
    – Orphans
    Sep 26, 2017 at 11:24
  • 1
    I see. However, it's good to note that you can use the DNS TXT record instead with certbot. I just did this last night. Sep 26, 2017 at 16:54
  • You are correct, you are more then welcome to edit this answer with that information! @DouglasGaskell
    – Orphans
    Sep 27, 2017 at 7:14
  • @DouglasGaskell would you please contribute your answer (step by step) to community? I'd like to see the implementation too..
    – T.Todua
    Nov 6, 2020 at 9:56

if the case it's similar to my servers at a site, in which I have the public ip ports 80 and 443 forwarded to the private ip ports 8080 and 8443, you can do it this way: certbot certonly --manual

that will ask you to make available a hash in a particular URL, easily accomplished by creating a file in your root webserver directory with the requested contents, i.e http://your.site.com/178412ufhjakjkaslkasflalifalafllkdflkjf and the challenge being adsjaskldlkajsdlkasdlakjsldjalskdasdada

so you create /var/www/html/178412ufhjakjkaslkasflalifalafllkdflkjf, and its contents should be adsjaskldlkajsdlkasdlakjsldjalskdasdada

hope it helps

  • 1
    --manual didn't work for me.
    – Felipe
    Oct 5, 2021 at 4:43
  • 1
    Thanks for this idea. It strictly doesn't answer the question, but it's an easy workaround for the case you have another website on the regular ports.
    – mgueydan
    Jul 7, 2022 at 20:26

I was believing that tls-sni is still possible, but based on the incident found, letsencrypt is advising people not to use tls-sni until future notice, for example the upcoming tls-sni-03 spec with challenges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.