Let's Encrypt Certificate improvements

I don't think you understand how Nginx works or what it is maybe?

so its like this I run a PC server it has a web server on port 443 for HTTPS and port 8080 for HTTP I also have a DNS-over-HTTPS with a Let's Encrypt then have nginx on where the web server is thats on port 80 the config (the important bits) is like this:

}
server {
listen 80;
server_name server.bridgemode.network;
location / {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
server {
listen 80;
server_name dns.bridgemode.network;
location / {
proxy_pass http://192.168.138.13:80;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}

So anything server.bridgemode.network goes to the web server on port 8080 and anything dns.bridgemode.network goes to the DNS-over-HTTPS server when certbot does setup or renew incoming traffic to port 80 that how the Certificate challenge is done will be for dns.bridgemode.network

as Nginx is a proxy traffic will be like this

source IP > WAN IP:80 >Nginx> 192.168.138.2 > 192.168.138.13:80 to DNS-over-HTTPS server when it opens port 80 for challenge 

so what I would do is add to the above setup like

server {
listen 80;
server_name zyxel-router1.bridgemode.network;
location / {
proxy_pass http://192.168.138.100:88;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

so

source IP > WAN IP:80 >Nginx> 192.168.138.2 > 192.168.138.100:88 to USG

the reason to change port to like 88 is the UI thats on 80 for the USG I don't think the Certificate challenge will know that Nginx changed the port as returning traffic will come from source 80 by Nginx.

Hi Tina

Yes I get it needs port 80 but do you understand how how Nginx works?
https://nginx.org/

I did a test of my method and it works HTTP-01 challenge validation will not know port 80 was changed the challenge comes in on port 80 to Nginx then proxy by port 88 then USG maps it back to 80 to my linux mint that did the challenge but really it should work without mapping from 88 to 80?

I think there can be security issue with port 80 to FLEX H even if you don't know it yet unless you have coded for when port 80 is waiting for the challenge you block UI access for port 80 which is why I would like the port to be changeable so that Nginx can proxy the given domain from port 80 to another port on the USG for the challenge to be done.

as another side question is the HTTP-01 challenge only on External or can it work on General or Internal if proxyed to the gateway

Nginx would allow port 80 to be open without downtime when doing the challenge

server {

    listen       80;

    server_name  dns.bridgemode.network;

location / {

	proxy_pass http://192.168.138.13:80;

	proxy_set_header Host $host;

 	 	proxy_set_header X-Real-IP $remote_addr;

	 	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

 		proxy_set_header X-Forwarded-Proto $scheme;

	}

}

server {

listen       80;

server_name  home-assistant.bridgemode.network;

location / {

proxy_pass http://192.168.138.12:88;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

}

server {

listen       80;

server_name  hub5.bridgemode.network;

location / {

proxy_pass http://192.168.138.12:88;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Forwarded-Proto $scheme;

}

so like I have a dns.bridgemode.network on linux mint DoH Server Certificate that the challenge only does for the given subdomain by Let's Encrypt
.

And home-assistant.bridgemode.network and hub5.bridgemode.network that the proxy to 192.168.138.12 port 88 to FLEX 700H Secondary IP where I do

and get a Certificate there for them subdomain by Let's Encrypt to it Nginx config

so what I would like is a just a optional port change that can close itself when its do and is only for the challenge on what interface please it really will work and Nginx takes case of the inbound port 80 handing.

And also using Nginx in this way solves completely the how do we Certificate for many devices that only has one WAN IP for port 80 like other USG, switches and AP's