All External IP Root CA Let's Encrypt

[ivn.mrz]

Hello! I have a script that validates certificates (released via Let's Encrypt).
The host on which it is executed needs to restrict access to the Internet, but maintain access to external addresses Let's Encrypt CA (whitelist).
I checked with WireShark where exactly it is accessing and what port \ protocol.

Result:
a2-19-204-139.deploy.static.akamaitechnologies.com [2.19.204.139]
по 80 \ TCP

I need all external addresses \ pools (besides the one shown above) that a root Let's Encrypt CA might have.

Where can I get this information?

[orangepizza]

as both crl and ocsp url need to be unencrypted http (because otherwise create circuler depanency, can you create a secure caching proxy about it?

[danb35]

@ivn.mrz

Where can I get this information?

You can't, and that's by design. They can change their IPs at any time, have done it before, and almost certainly will again.

[ivn.mrz]

@orangepizza

as both crl and ocsp url need to be unencrypted http (because otherwise create circuler depanency, can you create a secure caching proxy about it?

It's hard to say. We haven't considered this option.

[ivn.mrz]

@danb35 and what's the idea?

[bruncsak]

You may not want to restrict the access to a set of IP addresses, rather to a set of URL's. That's why @orangepizza's idea for a secure proxy is very good.

In fact you may restrict to IP addresses, if you manage the list of IPs dynamically, via looking up the IP of the CRL hosts frequently, and updating the list. It isn't pefect, and I think it is not worth the effort.

[webprofusion]

Get your certificates on a host that doesn't need to be restricted and deploy them to a secrets vault (and pull them periodically on the target host), or ssh/sftp then to the target host.

[Osiris]

@ivn.mrz

I have a script that validates certificates (released via Let's Encrypt).

Why do you need LEs external IP addresses when you're validating certificates?

Or perhaps I just don't follow what you mean with "validates certificates"?

Now, if you'd say "validating hostnames", then we're talking about something else. But that's not what you're saying. You mention "validates certificates" quite clearly?

[ivn.mrz]

@Osiris

Why do you need LEs external IP addresses when you're validating certificates?

Or perhaps I just don't follow what you mean with "validates certificates"?

Now, if you'd say "validating hostnames", then we're talking about something else. But that's not what you're saying. You mention "validates certificates" quite clearly?

Because when checking certificates via the OCSP protocol, there is a request to external addresses of the Root CA

[Osiris]

Ah, well, OCSP is already not getting embedded for new LE certs for a while now, only some soon-to-be-expired certs still have it.

That said, same troubles could be present for the CRL list URIs though..