Possible to Install New Cert on Port <> 80?

[kelunik]

Possible to Install New Cert on Port <> 80?

[kelunik]

Either way, I'm closing this now, as possible workarounds have been mentioned.

[kelunik]

This is a limitation by the ACME protocol, it only allows HTTP validation using port 80. Validating on other than the well-known ports 80 for HTTP might be a security issue with shared hosts that aren't configured properly, where anyone can open other ports.

There are other challenge types like SNI over port 443 or a DNS challenge, but those are not supported by this client.

What's the reason for not using port 80? Do you have (another) server running on port 80?

[ComputerTinker]

The reason we use a non-standard port on this server is because it's a QA server that's meant for use only by select clients, not the general public.

Looks like I'll have to find a client that supports the DNS challenge method. I see that the Perl client does, but it's giving me some errors when I try to install it... Anyway, thanks for the response.

[kelunik]

In that case you can just use the certificate of the primary server and you'll be fine. If you want a separate certificate, you can either use the primary web root for verification or redirect /.well-known/acme-challenge to the new port, but it'll be hard to differentiate. I'd just use the certificate you already obtained for the primary service running on port 80.

[ComputerTinker]

There is no primary server running on port 80, and port 80 isn't open in our firewall. The only server we have from our location is the QA server running on an alternate port. Once the code has been QA'd by the client we promote it to a production server which is hosted elsewhere.

[kelunik]

What's the reason to use a non-standard port then? Security though obscurity?

[ComputerTinker]

Yes.

[kelunik]

The hostname will anyway be public, because Let's Encrypt publishes all certificates in CT logs. Security through obscurity doesn't really add any security.

I think I'd propose to use port 80 / 443 and use something like basic auth for the client.

[ComputerTinker]

Yes, I know, I suggested that too, but it's not my decision. ;-)

[kelunik]

But in any way, you could just open port 80 purely for the challenges and not host anything there, works, too.