Aws Private Network Port Forwarding

Question

I have 2 subnets, one private and one public. I need to renew the certificate by using letsencrypt on the private subnet. I’m able to do this by creating an instance in public and routing (dns, iptables). How can I do this by using AWS services in a private zone without creating a public instance? i.e "Nat Gateway".

Answer 1

I'd use the DNS-01 challenge type, that way you don't need connectivity to your private instance.

If you wanted to allow your private instance access to the internet to use the HTTP-01 challenge type then you deploy a NAT gateway or NAT instance to your public subnet, and have the private subnet route 0.0.0.0/0 to that resource. A NAT instance is much cheaper, but you have to update / manage it. You can create either resource just during certificate renewal time, but it would be much easier to set up automatic renewals which means the NAT resources runs all that time.

Certbot supports automate renewals.