How we can get LetsEncrypt Certificate validated using ELB?

Question

Problem is that faced was when we pointed the DNS to ELB, It was not able to get certificate validation from LetsEncrypt however it worked when we did edited DNS to EC2 servers IP. --> This is OK if we have one server but what if we have many servers it won't work. Hence, we want this LetsEncrypt to

Answer 1

Letsencrypt still needs to use port 80. If your ELB is only forwarding port 443 for normal traffic you can use the following approach.

1. Forward port 80 to a small instance only running NGINX and certbot.
2. Initiate the cert renewal process from the this NGINX box.
3. Upload cert from NGINX box to ELB.

For extra points you can normally have port 80 disabled on your ELB and only open it when doing the renewal request.

Example setup is here: https://blog.cloudinvaders.com/installing-a-lets-encrypt-certificate-on-an-elastic-load-balancer/