How to get a certificate using Letsencrypt and Nginx - one domain with two IP addresses?

Question

Nginx

There are two A-records in DNS at example.myapp.com1.1.1.1 and 2.2.2.2 for example (i.e. DNS balancing). There is no access to the DNS server.

How on both servers to receive the certificate for example.myapp.comthrough letsencrypt? That is, when called on host 1.1.1.1:

letsencrypt certonly -a webroot -w /var/www/acme -d example.myapp.com

thanks to DNS balancing, letsencrypt's checking bot can randomly get to both 1.1.1.1 and 2.2.2.2, and there will be an error.

What are the solutions? I googled about a scheme with a redirect from one node to another when accessing location /.well-known:

return 301 http://node2.myapp.com$request_uri;

so that the letsencrypt bot always gets to the second node for verification. I did this and it didn’t work out for me, and I don’t understand the logic either: well, he’ll go to the second host, and then what? how will it create a temporary file there in /.well-known/acme-challenge/<token>order to confirm ownership of the server? It would have happened if letsencrypt had the opportunity not to generate a random file, but to use some static file for confirmation, which I will put and it will check on the second node, but I did not find something like that, or looked badly.

Answer 1

1.
Synchronize the /var/www/acme folder between servers, in principle you don’t even have to worry and mount one to the other via
fstab there, then
not just a proxy, but in a 404 error, in which case you will give it locally, if 404 then from there.
Or chelez upstream.

Answer 2

Let`s Encrypt has a confirmation method that is not related to unpacking files - for example, using TXT records. In your case, in my opinion, this is the most suitable option.

Answer 3

The best solution is not to injure your head with this miserable free canoe, but buy a normal certificate and specify the necessary hosts and names with your hands.

Answer 4

There is a plugin for nginx that does all the low-level work of updating Letsencrypt SSL certificates for you. Is not it so?