Ssl – Certbot fails. Enable Let’s Encrypt certbot on a new server that will replace the existing production server

domain-name-systemlets-encryptssl

I have an nginx web server with an SSL certificate provided by Let’s Encrypt using Certbot. For example, this site is publically available at https://example.com

New server
I’m creating a new server that will replace that existing server once everything is setup and deployed correctly.

I want it to be available at https://beta.example.com while setting it all up, and then at https://example.com once approvals are met.

https://beta.example.com could be available now as no other server serves a site at that subdomain, but example.com would only work when I eventually update the DNS records.

I need the existing web server obviously to continue without impact until the new server is ready.

How can I create an SSL certificate for the new server in preparation for it to take over eventually?

Problem with verifying domain
When I run certbot, it tries to access https://example.com as part of the verification, however it fails because that domain points to the IP address of the existing server.

Failed authorization procedure. example.com (tls-sni-01): urn:acme:error:tls ::
The server experienced a TLS error during domain verification :: remote error: tls: handshake failure

IMPORTANT NOTES:
– The following errors were reported by the server:

Domain: example.com
Type: tls
Detail: remote error: tls: handshake failure

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
you have an up-to-date TLS configuration that allows the server to
communicate with the Certbot client.

Is there an appropriate process to resolve that, given what I'm trying to do?

Best Answer

Try using a reverse proxy. Create two virtual hosts on your old server, which owns example.com, and direct beta.example.com there. The virtual host with beta.examply.com should strip HTTPS and reverse-proxy requests to actual server via HTTP. Both virtual hosts will use same certificate. All Letsencrypt stull will be on older server for now.

When you are ready, you copy certificate to new server, update DNS and wait for it to settle (at least for DNS TTL seconds). When you see all requests are reaching the new server, you can either reverse things or just move Letsencrypt stuff and move to new completely.

Related Topic