# Let's Encrypt cert never issues via StartTunnel gateway (StartOS 0.4.0 + StartTunnel 1.3.0, VPS behind 1:1 NAT) **URL:** \ **Category:** StartOS Support\ **Created:** [September 23, 2026, 5:23am UTC](https://community.start9.com/t/lets-encrypt-cert-never-issues-via-starttunnel-gateway-startos-0-4-0-starttunnel-1-3-0-vps-behind-1-1-nat/5759 "2026-09-23T05:23:03Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![gmoney](https://community.start9.com/letter_avatar_proxy/v4/letter/g/ee59a6/32.png) [@gmoney](https://community.start9.com/u/gmoney)\ **Post date:** [September 23, 2026, 5:23am UTC](https://community.start9.com/t/lets-encrypt-cert-never-issues-via-starttunnel-gateway-startos-0-4-0-starttunnel-1-3-0-vps-behind-1-1-nat/5759/1 "2026-09-23T05:23:03Z")
**Setup** - StartOS 0.4.0 (upgraded Sep 21), running DocuSeal 3.2.6 - StartTunnel 1.3.0 on a small VPS (Debian 12) at a provider that uses 1:1 NAT: the VM only sees an internal IP (call it INTERNAL\_IP), mapped externally to a public IP (EXTERNAL\_IP) - Public domain `sub.example.com` added on the StartTunnel gateway in StartOS, CA = Let’s Encrypt - DNS A record → EXTERNAL\_IP (DNS-only, verified resolving) **What I did for the NAT** Initially StartTunnel bound 443 to EXTERNAL\_IP, which the VM can’t receive on under 1:1 NAT. Fixed with: `start-tunnel subnet /24 set-wan --wan-ip INTERNAL_IP` After that `ss -tlnp` shows the SNI demux on `INTERNAL_IP:443`. A manual published port for 80 → my-server:80 exists, and the Published Ports UI shows both it and the automatic 443 hostname entry on INTERNAL\_IP. **What works** - Tunnel is up; StartOS shows the StartTunnel gateway with WAN IP = EXTERNAL\_IP, regular PCP ANNOUNCE in `journalctl -u start-tunneld` - StartOS Address Requirements: DNS ✓, port 443 ✓ - From the VPS: `curl -sSI http:///` → 200 (tunnel path to the service) - From the VPS: `curl -sSI -H "Host: sub.example.com" http://INTERNAL_IP/` → 200 (NAT’d port-80 path) - From outside (phone on cellular): the TLS connection completes, but the server presents the StartOS Local Intermediate CA cert → browser HSTS block **What doesn’t** - The Let’s Encrypt certificate never issues. crt.sh shows no certificates ever logged for this hostname. - No StartOS notification and no visible error. Toggling the public domain off/on several times over a few hours changed nothing. - `journalctl -u start-tunneld` contains only routine PCP/websocket lines, nothing ACME-related. **Questions** 1. Where does StartOS 0.4.0 log ACME attempts and failures? Nothing appears in Notifications or the OS Logs view. 2. Behind a StartTunnel gateway, does the Let’s Encrypt flow use HTTP-01 on 80 or TLS-ALPN on 443? Is anything extra required when the gateway’s WAN IP is set to a NAT-internal address? 3. Is there a way to manually trigger a certificate request or view the last ACME error? ---
**Author:** ![George](https://community.start9.com/user_avatar/community.start9.com/george/32/91_2.png) [@George](https://community.start9.com/u/George)\ **Post date:** [September 24, 2026, 3:13pm UTC](https://community.start9.com/t/lets-encrypt-cert-never-issues-via-starttunnel-gateway-startos-0-4-0-starttunnel-1-3-0-vps-behind-1-1-nat/5759/2 "2026-09-24T15:13:35Z")
From StartTunnel’s [documentation](https://docs.start9.com/start-tunnel/1.0.x/installing.html): > Warning > Publishing ports requires a **dedicated public IPv4 address** assigned to your VPS. Shared IPv4 addresses (CGNAT, shared NAT, or load-balanced IPs) will not work. … Confirm with your VPS provider that the IPv4 address is dedicated to your VM before purchasing. 1. I would have said the OS logs, but maybe it doesn’t log ACME attempts and failures. 2. I don’t know for sure – have to have your LLM check the code from either master: [start-technologies/projects/start-os at master · Start9Labs/start-technologies · GitHub](https://github.com/Start9Labs/start-technologies/tree/master/projects/start-os) But there’s a lot of things fixed there that aren’t in v0.4.0.1, so you might want to have it only look at that branch: [start-technologies/projects/start-os at start-os/v0.4.0.1 · Start9Labs/start-technologies · GitHub](https://github.com/Start9Labs/start-technologies/tree/start-os/v0.4.0.1/projects/start-os) ---
**Author:** ![gmoney](https://community.start9.com/letter_avatar_proxy/v4/letter/g/ee59a6/32.png) [@gmoney](https://community.start9.com/u/gmoney)\ **Post date:** [September 24, 2026, 6:57pm UTC](https://community.start9.com/t/lets-encrypt-cert-never-issues-via-starttunnel-gateway-startos-0-4-0-starttunnel-1-3-0-vps-behind-1-1-nat/5759/3 "2026-09-24T18:57:55Z")
thank you i have resolved