9 ms·

Sadly Let's Encrypt still doesn't work if your ISP blocks port 80 and 443.

jrochkind1 11y ago
I don't get it. If your ISP blocks port 80 and 443 incoming, how would you possibly deploy a website anyway? What do you need an ssl cert for if you can't deploy a website anyway?
- xxpor 11y ago
  It's entirely possible to deploy websites on ports other than 80 and 443.
- rakoo 11y ago
  > What do you need an ssl cert for if you can't deploy a website anyway? SSL certs are used to secure TLS connections, not just websites connections. So you can host a mail server, a mumble server, an XMPP server, or really anything that speaks TLS. Let's encrypt has been explicitely created for websites, but that doesn't mean its certs must be used for websites only.
- AndyKelley 11y ago
  I run a music server[1] on my home server so I can listen to music anywhere. I serve it on a port other than 80 and 443 since my ISP blocks those ports. If I access the web interface over HTTP, the admin password is sent in clear text, which means someone on the network I connect to could get my password and delete my music, or god forbid, secretly mistag some of it. * [1]: http://groovebasin.com/ http://groovebasin.com/
  - ceejayoz 11y ago
    Since it's for personal use, you can fire up something like an EC2 server, point the domain there for a few minutes, and provision a LE certificate. Copy down the generated key/cert files and you're in good shape for three months.
    - AndyKelley 11y ago
      I understand this would work, but obviously this is not free, and it's certainly not elegant or optimal.
      - ceejayoz 11y ago
        It's free - AWS free tier - and if it weren't it'd cost you less than $0.10/year for the couple hours of AWS nano instances you'd need.
        AndyKelley 11y ago
        It's not free. "The AWS Free Tier includes services with a free tier available for 12 months following your AWS sign-up date" https://aws.amazon.com/free/ https://aws.amazon.com/free/
        ceejayoz 11y ago
        Way to skate past the second part. A t2.nano instance costs $0.0065/hour. You need it for a few minutes every three months.
detaro 11y ago
The DNS authentication doesn't require any ports?
- AndyKelley 11y ago
  DNS authentication hasn't landed yet: https://community.letsencrypt.org/t/dns-authentication-is-really-needed/5377 https://community.letsencrypt.org/t/dns-authentication-is-re... https://community.letsencrypt.org/t/how-to-use-authenticate-with-a-dns-record/5267 https://community.letsencrypt.org/t/how-to-use-authenticate-...
  - Gigablah 11y ago
    Can't you use a different port? I believe you can use something like 4443 for the challenge. https://community.letsencrypt.org/t/apache-listening-on-a-different-port/8701 https://community.letsencrypt.org/t/apache-listening-on-a-di...
    - detaro 11y ago
      No, that example just uses port 4443 internally. You have to use port 80 or 443.
  - detaro 11y ago
    According to this it's online. https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152 But it is weird that there isn't a more "formal" announcement, and I haven't tried it...
    - pfg 11y ago
      Server support has landed, but there's no support in the official client yet (some third-party clients do support it). They're probably waiting for that to land before making a bigger announcement.

I don't get it. If your ISP blocks port 80 and 443 incoming, how would you possibly deploy a website anyway? What do you need an ssl cert for if you can't deploy a website anyway?

xxpor 11y ago
It's entirely possible to deploy websites on ports other than 80 and 443.
rakoo 11y ago
> What do you need an ssl cert for if you can't deploy a website anyway? SSL certs are used to secure TLS connections, not just websites connections. So you can host a mail server, a mumble server, an XMPP server, or really anything that speaks TLS. Let's encrypt has been explicitely created for websites, but that doesn't mean its certs must be used for websites only.
AndyKelley 11y ago
I run a music server[1] on my home server so I can listen to music anywhere. I serve it on a port other than 80 and 443 since my ISP blocks those ports. If I access the web interface over HTTP, the admin password is sent in clear text, which means someone on the network I connect to could get my password and delete my music, or god forbid, secretly mistag some of it. * [1]: http://groovebasin.com/ http://groovebasin.com/
- ceejayoz 11y ago
  Since it's for personal use, you can fire up something like an EC2 server, point the domain there for a few minutes, and provision a LE certificate. Copy down the generated key/cert files and you're in good shape for three months.
  - AndyKelley 11y ago
    I understand this would work, but obviously this is not free, and it's certainly not elegant or optimal.
    - ceejayoz 11y ago
      It's free - AWS free tier - and if it weren't it'd cost you less than $0.10/year for the couple hours of AWS nano instances you'd need.
      - AndyKelley 11y ago
        It's not free. "The AWS Free Tier includes services with a free tier available for 12 months following your AWS sign-up date" https://aws.amazon.com/free/ https://aws.amazon.com/free/
        ceejayoz 11y ago
        Way to skate past the second part. A t2.nano instance costs $0.0065/hour. You need it for a few minutes every three months.

detaro 11y ago

The DNS authentication doesn't require any ports?

AndyKelley 11y ago
DNS authentication hasn't landed yet: https://community.letsencrypt.org/t/dns-authentication-is-really-needed/5377 https://community.letsencrypt.org/t/dns-authentication-is-re... https://community.letsencrypt.org/t/how-to-use-authenticate-with-a-dns-record/5267 https://community.letsencrypt.org/t/how-to-use-authenticate-...
- Gigablah 11y ago
  Can't you use a different port? I believe you can use something like 4443 for the challenge. https://community.letsencrypt.org/t/apache-listening-on-a-different-port/8701 https://community.letsencrypt.org/t/apache-listening-on-a-di...
  - detaro 11y ago
    No, that example just uses port 4443 internally. You have to use port 80 or 443.
- detaro 11y ago
  According to this it's online. https://twitter.com/letsencrypt/status/689919523164721152 https://twitter.com/letsencrypt/status/689919523164721152 But it is weird that there isn't a more "formal" announcement, and I haven't tried it...
  - pfg 11y ago
    Server support has landed, but there's no support in the official client yet (some third-party clients do support it). They're probably waiting for that to land before making a bigger announcement.