Certbot 获取 ssl 证书 HAproxy

Question

I'm new to networking and I need to add an SSL certificate to my load balancer. For that, I'm using Certbot.

Instructions: https://certbot.eff.org/instructions?ws=haproxy&os=ubuntufocal

Basically it says to login to the server using SSH and then install certbot

Then, to run this command

sudo certbot certonly --standalone

It tells me to temporarily stop my web server to get the certificate, so I ran:

sudo service ssh stop

After running the certbot command I get the following error:

Could not bind TCP port 80 because it is already in use by another process on
this system (such as a web server). Please stop the program in question and then
try again.

So I ran:

sudo netstat -tulpn | grep :80

Output:

tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      59283/nginx: master 
tcp6       0      0 :::80                   :::*                    LISTEN      59283/nginx: master 

Now, If I stop the nginx service with "sudo service nginx stop" and run the above command again I don't get any services listening in port 80. So I retry the Certbot command once more:

sudo certbot certonly --standalone

I get the following error:

Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
  Domain: totaldomainoftheworldclub.tech
  Type:   dns
  Detail: no valid A records found for totaldomainoftheworldclub.tech; no valid AAAA records found for totaldomainoftheworldclub.tech

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.

And that's it, I don't know what else to do.

Answer 1

If you have trouble with normal validation, you can try using DNS challenge

Please note, that for DNS challenges, the following DNS providers are supported: cloudflare, cloudxns, digitalocean, dnsimple, dnsmadeeasy, gehirn, google, linode, luadns, nsone, ovh, rfc2136, route53, sakuracloud.

You can check how to use DNS challenges and what additional configuration it requires in the certbot docs . But basically, you will need to create some kind API key in your domain DNS server and then provide it to certbot. Then when validating it will automatically add a new DNS record using API for validation purposes.

You can also run DNS challenges in different machines or even in Google Function or AWS lambda . Check certbot-lambda for example.