Let's Encrypt forward requests to the correct internal server (DNS-NAT)

[Sebastian757]

Hello,

We have successfully been running Let's Encrypt certificate renewals.
There is a security rule for Let's Encrypt IPs on port 80 to our web server's external IP addresses and corresponding NAT rules for forwarding to the internal web servers. This works very well.

Now, however, several internal web servers are hiding behind one external IP, all of which want to renew a Let's Encrypt certificate with different domains.

How do I set up a Checkpoint Security Gateway so that the requested domain is read from Let's Encrypt accesses and then forwarded to the correct internal web server?
You can specify domains or FQDNs in the NAT rule, but then you also have to specify a domain name for the destination. However, the name is then resolved using either the external or internal IP address and therefore doesn't match the external or internal object entry.

So, how can I filter and forward requests based on the requested domain?

[PhoneBoy]

NAT does nothing for the Layer 7 information inside of HTTP, only the IP headers.
In any case, this is more like Reverse Proxy functionality: https://support.checkpoint.com/results/sk/sk110348
Not sure it will work in this case, otherwise you're looking at an RFE. 

[Pedro_Espindola]

Isn't the Mobile Access Reverse Proxy available only after logging in? That would prevent the inbound validation connection from Let's Encrypt.

[PhoneBoy]

This is a feature of Mobile Access Blade but this is not the Mobile Access Portal.
It won't require logging in.

[the_rock]

Might be worth TAC case to verify.

[Pedro_Espindola]

The best approach is to use a single certificate, with alt names for all your web applications, centralize the renewal in one server that listens to port 80 with the validation path /.well-known/acme-challenge correctly configured and use a renew hook script to copy the new cert to all your apps.

This approach would also let you use the certificate with inbound HTTPS Inspection, which you can automate using the Management API. To do that, create an inspection rule, get the rule UID, add the new certificate via API and replace the cert used in the rule. You cannot overwrite a certificate, just upload the new one and modify the rule.