Reachable from the Internet

[olealm]

I have 2 Esxi's on my network, both reachable from the Internet via 1 external IP address and 2 dedicated external IP-ports, then NATed to their respective internal IP adresses on port 443. I only have that 1 external IP address. Does this plugin require the use of external port 80 when renewing the certificate? Or can I specify what external port to use for the challenge and simply set up a permanent NAT in the Firewall? Alternatively, can I disable auto-renew, and renew the certificate manually, after having edited NAT each time?

[Churro]

Yes, port 80 is required by the domain validation that is done by Let's Encrypt. It's not a limitation of the plugin but of the HTTP-01 challenge that is fulfilled for Let's Encrypt in order to retrieve a certificate.

Editing NAT and triggering certificate renewal manually is not convenent but that would work.

[olealm]

Ok. I've set renewal to 90 days in .cfg and will do manual renewal. It's just a couple mns of manual labor each <90 days anyway, and the alternative is worse. Plugin works great, thanks.

[Churro]

You're welcome 😊