So, one of my servers is behind NAT, and since there is already a publicly accessible apache server going on my LAN, I decided to access it from the outside with different ports, and remap them to the standard port of the apache on this new machine I want to get a cert on. I did that with classic port forwarding via my router.Now, if I want to use letsencrypt on said server, it obviously fails because it tries to use the standard port, which will direct to my other server's apache installation (which btw. already has a letsencrypt-cert).Now I guess I need some way to tell letsencrypt to use my self-defined port instead of the standard one to connect from the outside, but I haven't found anything yet. Is that even possible? If it is, how?
Changing the port letsencrypt tries to connect on
certificates;nat;ipv4;letsencrypt
It's not possible to use non-standard port, as conforming ACME server will still try to contact default 80 / 443 for http-01 / tls-sni-01 challenges.E.g.certbot has a separate options for to listen to non-standard port, but that still doesn't help to pass the challenge:      certonly:        Options for modifying how a cert is obtained        --tls-sni-01-port TLS_SNI_01_PORT                              Port used during tls-sni-01 challenge. This only                              affects the port Certbot listens on. A conforming ACME                              server will still attempt to connect on port 443.                              (default: 443)        --http-01-port HTTP01_PORT                              Port used in the http-01 challenge.This only affects                              the port Certbot listens on. A conforming ACME server                              will still attempt to connect on port 80. (default:                              80)Probably in your case the best way would be to use another verification method -- webroot.In this case you don't need your 80 and 443 to be available to the outside world, but just a specific directory (which might be configured with proxy on webserver side, I assume).Details are available here