I have an Ubuntu 20.04 machine and I'm trying to install SSL via Certbot. The machine has a shared public NAT IPv4 and only a certain range of ports are available for use. I used DNS-01 for verification as I do not have access to port 80 on this machine.

Is it possible to use a different port than 443? I am trying to make this computer accessible via https://nat1.example.com:50463. I already have Apache2 running on 50462. I tried using the --tls-sni-01-port 50463 flag as suggested elsewhere, but that appears to no longer be valid. I used the following command, but it does not look like it's working (I didn't get the chance to specify a port anywhere).

certbot -d nat1.example.com --manual --preferred-challenges dns certonly

Is there any way to do this? Is there no other option than using a dedicated IP? If that's required, I could set up a proxy. I would really appreciate any info.

1 Answer 1


DNS challenge looks at the DNS records stored on the nameserver for the domain in question and doesn't require any communications to your local machine. It should have prompted you to add some TXT records to your DNS when you ran the above command?

  • Yes, and I have done that successfully. That's not the issue here. I'm trying instead to bind a port for https that is not 443, since I don't have that. I believe I figured how to do this using a ports config, will post info once I get it working.
    – undefined
    Commented Sep 10, 2020 at 14:25
  • I'm confused: you're talking about certbot using DNS challenge but then are talking about flags to try to make certbot access it on a TLS port. Once you have the cert via a DNS challenge, you no longer need to worry about setting ports that certbot will use. Commented Sep 10, 2020 at 15:03
  • HTTP's default port is 80. I don't have that. HTTP__S__ default port is 443. I don't have that either. I have ports 50462 to 50472 routed for this machine since this is a shared IP.
    – undefined
    Commented Sep 11, 2020 at 16:33
  • I think you're mixing up getting a certificate vs. hosting a website. Now that you have a certificate (via DNS challenge), you can host a TLS-enabled website on any port that you want. You just need to tell people the custom port so they can specify it when trying to reach your site. Commented Sep 11, 2020 at 18:44
  • I can connect to my webserver via HTTP on its custom port. However, it thinks that it has the entire IP to itself, and it's trying to run HTTPS on the default 443 port. I am trying to make it run on a port of my choosing. Changing this in ports.conf results in a certificate invalid error page from the browser.
    – undefined
    Commented Nov 20, 2020 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .