Let's Encrypt cert never issues via StartTunnel gateway (StartOS 0.4.0 + StartTunnel 1.3.0, VPS behind 1:1 NAT)

StartOS Support
1

Setup

  • StartOS 0.4.0 (upgraded Sep 21), running DocuSeal 3.2.6
  • StartTunnel 1.3.0 on a small VPS (Debian 12) at a provider that uses 1:1 NAT: the VM only sees an internal IP (call it INTERNAL_IP), mapped externally to a public IP (EXTERNAL_IP)
  • Public domain sub.example.com added on the StartTunnel gateway in StartOS, CA = Let’s Encrypt
  • DNS A record → EXTERNAL_IP (DNS-only, verified resolving)

What I did for the NAT
Initially StartTunnel bound 443 to EXTERNAL_IP, which the VM can’t receive on under 1:1 NAT. Fixed with:
start-tunnel subnet <subnet>/24 set-wan --wan-ip INTERNAL_IP
After that ss -tlnp shows the SNI demux on INTERNAL_IP:443. A manual published port for 80 → my-server:80 exists, and the Published Ports UI shows both it and the automatic 443 hostname entry on INTERNAL_IP.

What works

  • Tunnel is up; StartOS shows the StartTunnel gateway with WAN IP = EXTERNAL_IP, regular PCP ANNOUNCE in journalctl -u start-tunneld
  • StartOS Address Requirements: DNS ✓, port 443 ✓
  • From the VPS: curl -sSI http://<tunnel-ip-of-server>/ → 200 (tunnel path to the service)
  • From the VPS: curl -sSI -H "Host: sub.example.com" http://INTERNAL_IP/ → 200 (NAT’d port-80 path)
  • From outside (phone on cellular): the TLS connection completes, but the server presents the StartOS Local Intermediate CA cert → browser HSTS block

What doesn’t

  • The Let’s Encrypt certificate never issues. crt.sh shows no certificates ever logged for this hostname.
  • No StartOS notification and no visible error. Toggling the public domain off/on several times over a few hours changed nothing.
  • journalctl -u start-tunneld contains only routine PCP/websocket lines, nothing ACME-related.

Questions

  1. Where does StartOS 0.4.0 log ACME attempts and failures? Nothing appears in Notifications or the OS Logs view.
  2. Behind a StartTunnel gateway, does the Let’s Encrypt flow use HTTP-01 on 80 or TLS-ALPN on 443? Is anything extra required when the gateway’s WAN IP is set to a NAT-internal address?
  3. Is there a way to manually trigger a certificate request or view the last ACME error?
2

From StartTunnel’s documentation:

Warning
Publishing ports requires a dedicated public IPv4 address assigned to your VPS. Shared IPv4 addresses (CGNAT, shared NAT, or load-balanced IPs) will not work. … Confirm with your VPS provider that the IPv4 address is dedicated to your VM before purchasing.

  1. I would have said the OS logs, but maybe it doesn’t log ACME attempts and failures.
  2. I don’t know for sure – have to have your LLM check the code from either master:
    start-technologies/projects/start-os at master · Start9Labs/start-technologies · GitHub
    But there’s a lot of things fixed there that aren’t in v0.4.0.1, so you might want to have it only look at that branch:
    start-technologies/projects/start-os at start-os/v0.4.0.1 · Start9Labs/start-technologies · GitHub
3

thank you i have resolved