HTTPS Certificates on a NAT VPS: HTTP-01, DNS-01 and Ingress

A NAT VPS can use a valid TLS certificate, but obtaining a certificate and making a website reachable are separate tasks. Choose a certificate-validation method that matches your control of DNS and public ports.

HTTP-01 needs port 80

For Let's Encrypt HTTP-01 validation, the certificate authority requests a specific URL through public port 80. Merely running a server on a mapped high port does not satisfy that requirement. A suitable ingress proxy can route the challenge if you control the entry point.

TLS-ALPN-01 uses public port 443. It is also not a general workaround when that standard port is unavailable to your guest.

DNS-01 verifies DNS control

DNS-01 creates a TXT record under the validation name. It does not require inbound HTTP access to the VPS. Use a supported ACME client and narrowly scoped DNS credentials where automation is needed. Protect those credentials and test renewal as well as initial issuance.

A DNS-validated certificate does not open public port 443 or change a NAT mapping. Your users still need a reachable HTTPS endpoint, either with an explicit port or through a correctly configured ingress service.

Plan renewal and deployment

Use the certificate authority's staging environment when testing to avoid unnecessary issuance failures. Confirm which process reads the certificate, its file permissions and how it reloads after renewal. Keep the private key secret.

Autdo's NAT catalog does not imply that managed certificate issuance or a standard-port website proxy is included. Read website networking and Cloudflare port requirements.

Reference: Let's Encrypt challenge types.