4 ms·

Another nuisance is that unencrypted port 80 must be open to the outside world to do the acme negotiation (LE servers must be able to talk to your acme client r

Another nuisance is that unencrypted port 80 must be open to the outside world to do the acme negotiation (LE servers must be able to talk to your acme client running at the subdomain that wants a cert). They also intentionally don't publish a list of IPs that LetsEncrypt might be coming from [1]. So opening firewall ports on machines that are specifically internal hosts has to be a part of any renewal scripts that run every X days. Kinda sucks IMO. [1]https://letsencrypt.org/docs/faq/#what-ip-addresses-does-let-s-encrypt-use-to-validate-my-web-server https://letsencrypt.org/docs/faq/#what-ip-addresses-does-let... UPDATE: Apparently there is a DNS based solution that I wasn't aware of.

duskwuff 5y ago
Only true if you're using HTTP validation. Use DNS validation instead and this isn't an issue.
- pgroves 5y ago
  Fair enough. Although that seems rather complicated for those of us just trying to get a quick cert for an internal host. The LetsEncrypt forums are full of this discussion: [1] https://community.letsencrypt.org/t/whitelisting-le-ip-addresses-ranges-in-firewall/45190/6 https://community.letsencrypt.org/t/whitelisting-le-ip-addre... [2] https://community.letsencrypt.org/t/whitelist-hostnames-for-certbot-validation/115842/2 https://community.letsencrypt.org/t/whitelist-hostnames-for-... [3]https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760/2 https://community.letsencrypt.org/t/letsencrypt-ip-addresses...
wielebny 5y ago
That's not true. You can validate domains using dns-01, without exposing hosts.
- detaro 5y ago
  and even with HTTP challenge you don't have to expose the host directly, but e.g. can copy the challenge response to a public webserver from the internal host or from a coordinator server.
deleted 5y ago
[deleted]
rad_gruchalski 5y ago
But it is possible to have initial certificates without opening anything: https://gruchalski.com/posts/2021-06-04-letsencrypt-certificates-for-local-development/ https://gruchalski.com/posts/2021-06-04-letsencrypt-certific... From there, it’s possible to use HTTPS negotiation.
- pgroves 5y ago
  This looks kind of interesting. I might try this. Thanks.
nybble41 5y ago
As these are internal hostnames, you're probably doing a DNS-01 challenge rather than HTTP-01. With DNS-01 you don't need to open up any ports for incoming HTTP connections; you just need to place a TXT record in the DNS for the domain.

duskwuff 5y ago

Only true if you're using HTTP validation. Use DNS validation instead and this isn't an issue.

pgroves 5y ago
Fair enough. Although that seems rather complicated for those of us just trying to get a quick cert for an internal host. The LetsEncrypt forums are full of this discussion: [1] https://community.letsencrypt.org/t/whitelisting-le-ip-addresses-ranges-in-firewall/45190/6 https://community.letsencrypt.org/t/whitelisting-le-ip-addre... [2] https://community.letsencrypt.org/t/whitelist-hostnames-for-certbot-validation/115842/2 https://community.letsencrypt.org/t/whitelist-hostnames-for-... [3]https://community.letsencrypt.org/t/letsencrypt-ip-addresses-its-actually-pretty-important/129760/2 https://community.letsencrypt.org/t/letsencrypt-ip-addresses...

wielebny 5y ago

That's not true. You can validate domains using dns-01, without exposing hosts.

detaro 5y ago
and even with HTTP challenge you don't have to expose the host directly, but e.g. can copy the challenge response to a public webserver from the internal host or from a coordinator server.

deleted 5y ago

[deleted]

rad_gruchalski 5y ago

But it is possible to have initial certificates without opening anything: https://gruchalski.com/posts/2021-06-04-letsencrypt-certificates-for-local-development/ https://gruchalski.com/posts/2021-06-04-letsencrypt-certific... From there, it’s possible to use HTTPS negotiation.

pgroves 5y ago
This looks kind of interesting. I might try this. Thanks.

nybble41 5y ago

As these are internal hostnames, you're probably doing a DNS-01 challenge rather than HTTP-01. With DNS-01 you don't need to open up any ports for incoming HTTP connections; you just need to place a TXT record in the DNS for the domain.