local server with Let's Encrypt SSL certificate

Question

I'm running a Confluence server in my local domain that I want to access from the outside using OpenVPN.

Since I want to use the Confluence app, I need to enable SSL and use a cert which is stored in iOS. That rules out my local certificate chain.

I thought of using Let's Encrypt, but I'm not sure whether it's possible to issue certificates for my local domain. I've read various articles that suggest I can do it with a DNS challenge.

I've tried to update my zone.conf with the relevant TXT entry, but the DNS challenge fails with this message:

Failed authorization procedure. confluence.brave-vesperia.com (dns-01): 
urn:acme:error:dns  :: DNS problem: SERVFAIL looking up TXT for 
_acme-challenge.confluence.brave-vesperia.com

part of my bind config:

brave-vesperia.com. IN  SOA brave-vesperia.com. (
        1486898704
        10800
        3600
        604800
        38400 )

_acme-challenge.confluence.brave-vesperia.com. IN TXT "aJ0Y5HyJ0TBmebIqu5TMrQM4ceiZsYe2L1xDHrixdUo"

I can confirm that the bind server is running and working properly. I've also restarted it after adding the _acme-challenge part.

Is there anything blatantly wrong with my config? Can I check from the command line why the dns challenge fails?

 dig -t txt _acme-challenge.confluence.brave-vesperia.com 

returns the correct string.

Answer 1

For "DNS challenge" your domain DNS records must be public available. LE mechanisms will check your records from public DNS servers.

But your domain not presented anywhere in public area.

dig -t ns confluence.brave-vesperia.com 8.8.8.8 +short returns nothing.

dig -t ns brave-vesperia.com 8.8.8.8 +short returns nothing.