Put domain on cloudflare or another registrar that supports an API. Generate a token with the right privs.
Use certbot with the cloudflare plugin, and that token, and generate whatever certs you need within that domain using the DNS01 method.
No need to have port 80 open to the world, no need for a reverse proxy, no need for NAT rules to point it to the right machine, no need to even have DNS set up for the hostname. All of that BS is removed.
The token proves your authentication and LetsEncrypt will generate the certs.
How we’ve done it recently:
No need to have port 80 open to the world, no need for a reverse proxy, no need for NAT rules to point it to the right machine, no need to even have DNS set up for the hostname. All of that BS is removed.
The token proves your authentication and LetsEncrypt will generate the certs.