0

I cannot find in any documentation on how to server different sites for the same hostname with letsencrypt depending on the interface on which te request is handled?

I have for example this simple configuration:

<VirtualHost 10.0.0.3:80>
    ServerName internalwebsite.example.com
    ServerAdmin it@example.com

    DocumentRoot /var/www/internalwebsite.example.com/reachable_from_wan/

    ErrorLog ${APACHE_LOG_DIR}/internalwebsite.example.com_error.log
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/internalwebsite.example.com_access.log combined
</VirtualHost>

10.3 is the interface that is reachable from WAN, but I have another interface (10.4) that is only reachable from the intranet, but I want it to have the same domain name internalwebsite.example.com, like so:

<VirtualHost 10.0.0.3:80>
    ServerName internalwebsite.example.com
    ServerAdmin it@example.com

    DocumentRoot /var/www/internalwebsite.example.com/reachable_from_wan/

    ErrorLog ${APACHE_LOG_DIR}/internalwebsite.example.com_error.log
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/internalwebsite.example.com_access.log combined
</VirtualHost>
<VirtualHost 10.0.0.4:80>
    ServerName internalwebsite.example.com
    ServerAdmin it@example.com

    DocumentRoot /var/www/internalwebsite.example.com/reachable_from_intranet/

    ErrorLog ${APACHE_LOG_DIR}/internalwebsite.example.com_error.log
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/internalwebsite.example.com_access.log combined
</VirtualHost>

This works and apache servers different content depending on the interface reached, but:

It won't be available in certbos list of domains for which I would like to generate an HTTPS certificate (when running letsencrypt command on a debian machine).

My goal is to automate the renewal of a https certificate for an internal website, without having to make the intranet content reachable from WAN or without having to take the intranet content down (API's are querying it every few seconds so that's not an acceptable option).

How can I achieve what I want (see above vhosts file with two virtual hosts) and make it so that letsencrypt / certbot lists that domain so that I can generate an SSL certificate for it?

Note that internalwebsite.example.com is reachable from the internet! Which means letsencrypt can verify ownership, but it should verify it on the WAN side.

Edit:

External DNS (global DNS) points to the WAN IP (e.g. 44.55.66.77), and our internal DNS, when queried, returns 10.0.0.4.

The actual problem, after adding such vhost domain, letsencrypt won't allow to select the domain to generate an HTTPS certificate:

web@webserver:/etc/apache2/sites-available# letsencrypt
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
-------------------------------------------------------------------------------
1: example.com
2: other.example.com
3: somethingelse.example.com
-------------------------------------------------------------------------------
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):

internalwebsite.example.com is missing from this list, when I revert the vhost configuration back to only the internal document root (so removing the 10.0.0.3 section), letsencrypt lists the domain but ofcourse it can't verify the domain then. (Because when letsencrypt tries to verify identity, apache doesn't know any internalwebsite.example.com on 10.0.0.3), when I try to proceed this error happens:

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: internalwebsite.example.com
   Type:   unauthorized
   Detail: Incorrect validation certificate for tls-sni-01 challenge.
   Requested
   f547f5b0936dad4b0e1d28c325bc36c8.da1ceb11ae0bd36d221f546faede908a.acme.invalid
   from 11.22.33.44:443. Received 2 certificate(s), first certificate
   had names "example.com, other.example.com, somethingelse.example.com"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address.

Because now apache doesn't listen on 10.0.0.3 for internalwebsite.example.com but I can't take down the website on 10.0.0.4 and move it to 10.0.0.3 temporarily..

  • I don't understand where your problem is. If both interfaces share the same DNS name, you can use the same certificate for both. The interface is not relevant. – Gerald Schneider Oct 18 '17 at 13:49
  • The problem is when I run letsencrypt, the domain isn't listed anymore, so I can never even genereta a certificate to begin with – Gizmo Oct 18 '17 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.