使用certbot certonly为Glassfish网站更新SSL证书遇端口及验证问题求助

Got it, let's break down how to solve this problem—you're trying to grab an SSL cert for your Glassfish site using certbot certonly, but hitting port 80 conflicts with Glassfish, and when you stop Glassfish, the ACME challenge fails. Here are three solid approaches to get this working:

1. Use Webroot Mode (No Need to Stop Glassfish) #

This is the most seamless option because it leverages your running Glassfish instance to handle the ACME challenge, so you don't have to mess with ports or stop your app.

• First, create the required challenge directory in your Glassfish web app's root folder. Replace the path below with your actual app's deployment directory:

  mkdir -p /opt/glassfish5/glassfish/domains/domain1/applications/your-app/.well-known/acme-challenge
  

• Set proper permissions so Certbot can write to the directory and Glassfish can serve the challenge files:

  chown -R glassfish:glassfish /opt/glassfish5/glassfish/domains/domain1/applications/your-app/.well-known
  chmod -R 755 /opt/glassfish5/glassfish/domains/domain1/applications/your-app/.well-known
  

• Run Certbot in webroot mode, pointing it to your app's root directory and your domain(s):

  certbot certonly --webroot -w /opt/glassfish5/glassfish/domains/domain1/applications/your-app/ -d yourdomain.net -d www.yourdomain.net
  

Certbot will drop a temporary file in the .well-known/acme-challenge folder, and the ACME server will verify it by accessing your domain. Since Glassfish is already serving your site, it'll return the file automatically, and the challenge will pass without port conflicts.

2. Temporary Port Swap for Standalone Mode #

If you prefer using Certbot's standalone mode, you can temporarily move Glassfish off port 80 just long enough to complete the challenge:

• Log into your Glassfish admin console (default: http://localhost:4848), navigate to Configurations > server-config > Network Config > Network Listeners > http-listener-1, and change the port from 80 to something like 8080. Save the change and restart Glassfish.
• Run Certbot's standalone command:

  certbot certonly --standalone -d yourdomain.net -d www.yourdomain.net
  

• Once the cert is issued, go back to the Glassfish admin console and switch http-listener-1 back to port 80. Restart Glassfish again to apply the change.

3. DNS Validation (No Port 80/443 Required) #

If your domain registrar supports DNS API integration, this is the most hassle-free method—you don't need any web services running or open ports. Certbot will automatically add a DNS TXT record to verify domain ownership.

• Install the appropriate Certbot DNS plugin for your registrar (e.g., for Cloudflare, it's certbot-dns-cloudflare—check your registrar's internal docs for the exact plugin name).
• Run Certbot with the DNS plugin, replacing [provider] with your registrar's identifier:

  certbot certonly --dns-[provider] -d yourdomain.net -d www.yourdomain.net
  

• Follow the prompts to configure your API credentials. Certbot will handle adding and removing the TXT record automatically, and the challenge will pass without touching your Glassfish setup.

Why Did the Challenge Fail When You Stopped Glassfish? #

Most likely, one of these issues was happening:

• Your server's firewall was blocking port 80, so the ACME server couldn't reach Certbot's standalone service.
• Your domain's DNS record wasn't pointing to the correct server.
• Certbot failed to start its standalone web server properly (run the command with -v to see detailed logs and debug).

内容的提问来源于stack exchange，提问作者Emmanuel Saint-louis