{"id":"42f8d6f3-8e13-44ac-b7ad-1294eeb42643","task":"Obtain a certificate in standalone mode on a host that has no web server currently running, by having Certbot bind port 80 itself to complete the http-01 challenge.","domain":"certbot.eff.org","steps":["Install Certbot per https://certbot.eff.org/instructions (Snap is the docs' recommended method; also confirm no other process is bound to port 80).","Make sure port 80 is open to inbound internet traffic for the domain(s) you're requesting, and that nothing else (e.g. a web server) is already listening on it — standalone needs to bind port 80 itself.","Run: sudo certbot certonly --standalone -d example.com","For multiple domains on one cert: sudo certbot certonly --standalone -d example.com -d www.example.com","If you need to control which interface/protocol Certbot binds, use --http-01-address to explicitly tell it which interface (and protocol) to bind.","Because certonly does not install the certificate anywhere, manually configure your web/application server to use the files under /etc/letsencrypt/live/example.com/ once you set one up.","For future renewals, since standalone needs port 80 free, use hooks to stop/start any server that later binds that port: certbot renew --pre-hook \"service nginx stop\" --post-hook \"service nginx start\"","Official docs: https://eff-certbot.readthedocs.io/en/stable/using.html, https://eff-certbot.readthedocs.io/en/stable/install.html"],"gotchas":["Standalone mode requires exclusive use of port 80 during validation; if a web server is already running you must stop it first, or use webroot mode instead so you don't have downtime.","By default Certbot first tries to bind the port on all interfaces via IPv6, then IPv4; it continues as long as at least one bind succeeds (on most Linux systems IPv4 gets routed to the bound IPv6 port, so a 'failed' second bind is expected and not an error).","certonly only obtains the certificate — it does not install/configure any server, so you must wire the resulting cert/key paths into your service yourself.","If you rely on standalone for renewals, you must supply --pre-hook/--post-hook (or drop scripts in /etc/letsencrypt/renewal-hooks/pre and .../post) so the port is freed for Certbot and your server restarts afterward; otherwise scheduled renew will fail to bind port 80."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T05:31:47.989Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T05:31:47.989Z"},"url":"https://mcp.waymark.network/r/42f8d6f3-8e13-44ac-b7ad-1294eeb42643"}