Letsencrypt 为具有内部 IP 地址的主机设置失败

[noodle]

你好，我正在尝试在一台 Ubuntu 机器上首次设置 Discourse。该平台仅计划在公司内部网络中访问，因此我们在 DNS 提供商处注册的域名所对应的 IP 地址是一个内部 IP。

我参考了以下教程进行操作：How to Install Discourse Forum with Nginx on Ubuntu 16.04

我已经成功完成了引导和启动。但第 3 步（生成 SSL 证书，使用 Let’s Encrypt）失败了，错误信息如下：

授权过程失败。<已移除的域名> (http-01): urn:ietf:params:acme:error:dns :: 未找到<已移除的域名>的有效 IP 地址

在该机器上运行 nslookup 可以解析出该域名对应的 IP 地址，我也能够 ping 通该域名。

我认为问题可能出在主机 IP 是内部地址这一点上。我找到了这篇文章，但不确定该如何继续：No valid IP addresses found for (my domain) - #8 by _az - Help - Let's Encrypt Community Support

[Remah (Just another happy Discourse user)]

Let’s Encrypt 需要从互联网访问您的 IP 地址。

以下主题/帖子可能会有所帮助：

Https with let's encrypt behind a vpn?

If your server isn’t publicly accessible then Let’s Encrypt can’t verify that the DNS name resolves. If it were possible for servers to get Let’s Encrypt certificates without first verifying this, then all kinds of mischief would be possible. Even if you can bodge this to temporarily get access and issue a certificate, it will fail for renewals. VPN can’t help you here. You’re going to need to either: ask your university if they operate a Certificate Authority and can issue the server a cer…

https://meta.discourse.org/t/adding-a-dns-name-to-an-ip-based-install/102898/2?u=remah

Using a certificate when Discourse is installed behind a reverse proxy

You’ve skirted around answering my question somewhat. Is there a valid public DNS record pointed at the public IP of the server? Are :80 and :443 externally accessible on that hostname and IP?