11

I want to set up certbot for a webserver on a different port than 443. I got the following error when running

certbot --apache -d <sub>.<domain>.<ext>

Failed authorization procedure. sub.domain.ext (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to external_ip:443 for TLS-SNI-01 challenge

After this error I've read the man pages, where I found this:

--tls-sni-01-port TLS_SNI_01_PORT Port number to perform tls-sni-01 challenge. Boulder in testing mode defaults to 5001. (default: 443)

Then I tried the following to correct this error:

certbot --apache --tls-sni-01-port 14831 -d <sub>.<domain>.<ext>

After adding the tls-sni-01-port, I got the same error.

Is it possible to install a certificate with a different port, or am I doing something wrong?

  • Could you please provide us with the documentation for certbot that states how to use "--tls-sni-01-port 14831"? I have'nt seen it there, yet – Orphans Sep 27 '16 at 17:35
  • --tls-sni-01-port TLS_SNI_01_PORT Port number to perform tls-sni-01 challenge. Boulder in testing mode defaults to 5001. (default: 443) – CaptainJack Sep 27 '16 at 17:36
  • Have you tried --dvsni-port {PORT}? – Orphans Sep 27 '16 at 17:38
  • Read that, but if I try certbot --apache --dvsni-port <port> -d <sub>.<domain>.<ext> it says: certbot: error: unrecognized arguments: --dvsni-port <port> – CaptainJack Sep 27 '16 at 17:41
  • 1
    SSL could be on any port, you just need to specify the port number – CaptainJack Sep 27 '16 at 19:09
9

According to: https://community.letsencrypt.org/t/how-to-specify-a-port-different-from-443-for-the-dvsni-challenge/12753/4

This is not possible with certbot. You should take a look at the other implementation method here: https://community.letsencrypt.org/t/list-of-client-implementations/2103

  • 2
    Certbots FAQ seems to say otherwise? certbot.eff.org/faq/… – Douglas Gaskell Sep 26 '17 at 1:58
  • @DouglasGaskell The FAQ has changed since this answer was posted. But that does not change the answer actually. There is no way to issue an LE certificate on another ports then 80 or 443 according to the FAQ – Orphans Sep 26 '17 at 11:24
  • I see. However, it's good to note that you can use the DNS TXT record instead with certbot. I just did this last night. – Douglas Gaskell Sep 26 '17 at 16:54
  • You are correct, you are more then welcome to edit this answer with that information! @DouglasGaskell – Orphans Sep 27 '17 at 7:14
2

I was believing that tls-sni is still possible, but based on the incident found, letsencrypt is advising people not to use tls-sni until future notice, for example the upcoming tls-sni-03 spec with challenges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.