Let’s Encrypt, nginx and certbot – a short story

Well, the duration – for me -was not short. It was about two weeks of living in Google. 

Here’s the setup: I have a couple of servers in my DMZ that I want share out. Some places do not let web traffic out on non-standard ports (i.e., TCP 80 and 443) so I wanted to share out the two servers on my single IP address. As I like to try different things, I decided on using nginx instead of Apache HTTPD. (I like both – some things in nginx seem a little more organized…) Setting up nginx as a reverse proxy – no problem at all! 

Of course, I am – within reason, see my post on HTTPS everywhere – in agreement with encryption. Thus, Let’s Encrypt was next on the list. With my other static web servers (using Apache HTTPD) no problem; good old certbot is brain dead easy.

Not with a reverse proxy (I also tried Apache HTTPD without luck) – at least for me. Repeated 404 errors… “not authorized”… Arrrgggg… Google university was of no help – all the same basic instructions. Same error. 

Until… 

I found this post on StackExchange by ph4r05. Basically, I had to use a manual verification with the manual plugin. This meant adding a TXT record to my DNS server. 

To do this:

certbot -d YOUR_FQDN_SERVER_NAME --manual --preferred-challenges dns certonly

This will give the response:

Please deploy a DNS TXT record under the name
_acme-challenge.YOUR_FQDN_SERVER_NAME with the following value:

667drNmQL3vX6bu8YZlgy0wKNBlCny8yrjF1lSaUndc

Once this is deployed,
Press ENTER to continue

Of course, the value will change for you (and it will change each time you do a manual validation). Once you get that key you will need to go into your (publicly accessible!) DNS server with a TXT record of:

_acme-challenge.YOUR_FQDN_SERVER_NAME TXT 667drNmQL3vX6bu8YZlgy0wKNBlCny8yrjF1lSaUndc

(or however your DNS server enter it).

You then have to wait until Google’s name servers (8.8.8.8 or 8.8.4.4) updates. This took under 5 minutes for me. Once that is done (you can check with the linux dig command for propagation) hit ENTER. You will then have to put in your nginx site config the paths to the Let’s Encrypt certificates;e.g.,:

/etc/letsencrypt/live/YOUR_SITE_NAME/fullchain.pem/
/etc/letsencrypt/live/YOUR_SITE_NAME/pivkey.pem

Restart nginx – and Bob’s your uncle.

Hopefully, someone else will find this post and it will save some time.