2

Background

I have a primary website hosted on a LAMP-based VPS, with WHM and cPanel. I've installed the Let's Encrypt cPanel plugin to use with AutoSSL, and that is working for the main site.

Additionally, I have another site that I am hosting on a server myself, in our own building, with a dedicated IP address. I have a subdomain from my primary site that points to our IP address.

Goal

I want to use AutoSSL to protect the sub-domain, which isn't hosted on the same server that cPanel is installed.

What I've Done

I previously was pointing the sub-domain with a single DNS A record. I deleted that, and created an official sub-domain through cPanel's sub-domain page. At that point, I checked the DNS records and changed the A record to point to the right IP address.

Because of this, AutoSSL is now trying to create an SSL cert for the sub domain. My plan was to manually copy the cert and key files over to the other server. However, I'm getting an error.

The Problem

The error I'm getting is:

3:28:02 AM WARN The domain ... failed domain control validation: The content “...” of the DCV file, as accessed at “...”, did not match the expected value. The domain “...” resolved to an IP address “...” that does not exist on this server.

Question

Can I use AutoSSL to create the SSL certs for the other server? Or do I need to figure out how to manage the SSL directly from that server?

  • I use certbot, not AutoSSL for LetsEncrypt. I don't know if it will help your problem, but I have found that redirecting the /.well-known/acme-challenge/ directory works well when you want to generate the certs on another server. I do so to deal with load balanced servers, and intranet (not public facing) servers. I did a blog post about it which includes the Apache configuration for the redirect: blog.ostermiller.org/letsencrypt-migration – Stephen Ostermiller Jun 23 '17 at 13:16
  • I don't even know what /.well-known/acme-challenge/ is. I'm a CSS/JS/HTML/PHP front end guy, trying to figure all this SSL stuff out. I'll read through your post though, and see if it'll help my situation. Appreciate it. – Andy Mercer Jun 23 '17 at 15:08
  • 1
    To verify that you own your site, LetsEncrypt needs to be able to put a file into that directory on your web server. Whatever you end up doing your plan of manually copying certificates needs to be automated. LetsEncrypt certs are only valid for 90 days. You need automatic processes in place to renew them. – Stephen Ostermiller Jun 23 '17 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.