2

I use Firebase Hosting to host my website and a VPS to host a mailserver for the same domain.

When I try to issue a certbot Let's Encrypt SSL certificate I get the following error:

Could not request a Let's Encrypt SSL/TLS certificate for example.com.

Go to http://example.com/.well-known/acme-challenge/[long_string]

and сheck if the authorization token is available.

If it is, try to request the certificate again. If the token is not available, there may be an issue with your DNS configuration.

This URL leads to my 404 error page.

It can't issue the certificate because my website is hosted in a Firebase Hosting IP address, while my mailserver has another IP address.

What would be a viable way to get SSL for my emails? Can I get the SSL certificate from Firebase and import it in my VPS using a cron job to keep it up to date? Even if possible, this seems like a cumbersome solution to a simple problem.

Disclaimer: this question was originally asked by me on StackOverflow yesterday.

Improve this question
1
  • 1
    "It can't issue the certificate because my website is hosted in a Firebase Hosting IP address, while my mailserver has another IP address." As certificates are typically based on names, whatever the resolution to IP address is does not come into play. Do note also that there are multiple ways to validate a certificate for issuance, http-01 is one but you have also dns-01 that doesn't need a webserver at all.
    – Patrick Mevzek
    Mar 8 at 14:17

1 Answer 1

Reset to default
2

There is no single answer to this question.

Maybe the easiest solution would be to pay for an annual certificate and use that, rather then trying to add a new cert with Letsencrypt every 3 months.

I suggest a more professional way of handling things is to use a seperate subdomain - with a seperate cert - for your mail. It would be more typical to have a mail server named for example "mail.example.com" with an MX record for example.com telling it to deliver mail to mail.example.com. You would then have 1 cert for www.example.com and example.com for web hosting, and a separate one for mail.example.com.

Another possibility would be to use a DNS challenge (rather then an http challenge) to get a certificate for your mail server. You will, of-course, need access to your DNS to update the challenge records - something you will need to do every 3 months - ideally you will want to script a way to automate this (something Letsencrypt supports, but varies dramatically depending on how your DNS is set up)

Improve this answer
2
  • 1
    Thank you very much, @davidgo! My mailserver is already set up on a separate subdomain (mail.example.com) and has a Let's Encrypt certificate, but just to clarify, wouldn't I need a wildcard SSL certificate to get my emails (@example.com) covered? As far as I understand an SSL certificate for mail.example.com would cover only addresses associated with the subdomain: @mail.example.com
    – nickh
    Mar 7 at 22:52
  • 1
    No. The cert is used to identify a host and encrypt communication between hosts, not emails or users. Depending on your definition of secure you would need to use DKIM, SPF and/or PGP to secure mail at a per email address level. (Also, think about it - lots of people use gmail for their work domains - but they dont need to sort out certs for this)
    – davidgo
    Mar 8 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.