UPDATE (October 2026): the commands in step 3 and 4 below have been corrected. This guide was written in November 2016 against Ubuntu 16.04. The reverse-proxy configuration still works, but the certificate tooling was renamed shortly afterwards and the original commands will fail.
apt-get install python-letsencrypt-apache→ the package is nowpython3-certbot-apacheletsencrypt --apache→ the command is nowcertbot --apachesystemctl restart apache2→ prefersystemctl restart apache2
Current certbot’s Apache plugin also installs the HTTPS vhost and the redirect itself, and renews via a systemd timer — so the manual ProxyPass /.well-known ! juggling below is no longer required, though it remains harmless. See certbot.eff.org for your platform.
Scenario
You have a single incoming IP address and want to run multiple web servers for multiple sites behind this IP address on your local network. The best way to do this is using a reverse proxy server For example:
- Your External IP is: 8.8.8.8 with and internal LAN of 10.1.1.X
- Ports 80 (http) and 443 (https) have been forwarded from your external ip to an internal server at 10.1.1.2 which will handle the reverse proxy and SSL/TLS work using letsencrypt
- You have other application web servers listening on port 80 on your internal LAN at 10.1.1.11 and 10.1.1.12 but these are not accessible from outside your network.
- You have subdomain11.yourdomain.com and subdomain12.yourdomain.com both pointed to 8.8.8.8 and you want visitors to them to see the application servers at 10.1.1.11 and 10.1.1.12 respectively.
- You want to provide secure https access to both subdomains but don’t want to configure this on each of the three servers separately.
This guide was written against Apache2 on Ubuntu 16.04 (see the update above — the certbot commands have been corrected), some commands may differ slightly between different flavours of Linux but the core configuration for Apache2 should work on any distribution.