Score:0

Aws Private Network Port Forwarding

bh flag

I have 2 subnets, one private and one public. I need to renew the certificate by using letsencrypt on the private subnet. I’m able to do this by creating an instance in public and routing (dns, iptables). How can I do this by using AWS services in a private zone without creating a public instance? i.e "Nat Gateway".

Score:0
gp flag
Tim

I'd use the DNS-01 challenge type, that way you don't need connectivity to your private instance.

If you wanted to allow your private instance access to the internet to use the HTTP-01 challenge type then you deploy a NAT gateway or NAT instance to your public subnet, and have the private subnet route 0.0.0.0/0 to that resource. A NAT instance is much cheaper, but you have to update / manage it. You can create either resource just during certificate renewal time, but it would be much easier to set up automatic renewals which means the NAT resources runs all that time.

Certbot supports automate renewals.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.